Vulnerability Description
The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/getgrav/grav/security/advisories/GHSA-h33v-82r9-v8pm
- https://www.vulncheck.com/advisories/grav-login-plugin-privilege-escalation-via-
- https://github.com/getgrav/grav/security/advisories/GHSA-h33v-82r9-v8pm
FAQ
What is CVE-2026-65603?
CVE-2026-65603 is a vulnerability with a CVSS score of 8.8 (HIGH). The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike t...
How severe is CVE-2026-65603?
CVE-2026-65603 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-65603?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.