Vulnerability Description
Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissions.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/getgrav/grav/security/advisories/GHSA-985r-mpj8-5rqw
- https://www.vulncheck.com/advisories/grav-login-plugin-before-privilege-escalati
FAQ
What is CVE-2026-56710?
CVE-2026-56710 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login...
How severe is CVE-2026-56710?
CVE-2026-56710 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-56710?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.