Vulnerability Description
grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacker with admin.users permission can change the password of any user account, including the super administrator, by sending a direct POST request to /admin/user/{username}?task=save with data[password] because saveUser authorizes the caller's user-management permission but does not verify whether the caller may edit the target user. This issue is expected to be fixed in version 1.10.53.
Related Weaknesses (CWE)
References
- https://github.com/getgrav/grav-plugin-admin/commit/88f7ce8e50324472f492965caa42
- https://github.com/getgrav/grav/security/advisories/GHSA-p97c-g455-q447
- https://github.com/getgrav/grav/security/advisories/GHSA-p97c-g455-q447
FAQ
What is CVE-2026-59190?
CVE-2026-59190 is a documented vulnerability. grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacker with admin.users permission can change ...
How severe is CVE-2026-59190?
CVSS scoring is not yet available for CVE-2026-59190. Check NVD for updates.
Is there a patch for CVE-2026-59190?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.