CVE-2026-56710: Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-25 · updated 2026-10-12
Weakness: CWE-863

Description

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissions.

Affected products

getgrav grav: before 1.0.16 — fixed in 1.0.16

How to fix

Upgrade to a fixed version: getgrav grav 1.0.16. Check the vendor advisory for mitigations.

References

https://github.com/getgrav/grav/security/advisories/GHSA-985r-mpj8-5rqw
https://www.vulncheck.com/advisories/grav-login-plugin-before-privilege-escalation-via-unlock

Get alerted when CVE-2026-56710 or the next vulnerability affects your stack