CVE-2026-65603

Description

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.

Severity (CVSS)

Weaknesses

• CWE-269 — Improper Privilege Management

Affected products

References

• https://github.com/getgrav/grav/security/advisories/GHSA-h33v-82r9-v8pm (vendor-advisory)
• https://www.vulncheck.com/advisories/grav-login-plugin-privilege-escalation-via-profile-update (third-party-advisory)