CVE-2026-65603 Details
Description
The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.
A privilege escalation vulnerability has been identified in the Grav Login plugin (grav-plugin-login) versions through 3.8.11. The issue resides in the authenticated profile self-update handler, specifically the processUserProfile() function, which is part of the update_user task. Unlike the registration handler, this profile update handler fails to remove privilege-related fields, such as 'groups' and 'access', from user-submitted form data before saving it. As a result, a low-privilege authenticated user can manipulate profile form data to gain super-admin rights, provided that an administrator has configured the plugin to include 'groups' or 'access' in the user registration fields. This vulnerability is particularly concerning on the default 'regular' DataUser account backend, where it allows unauthorized access to the admin panel, exploitation of the scheduler for remote code execution, and evaluation of Twig templates.
Users can update to Grav Login plugin version 3.8.12 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | New CVE Received | [email protected] |