CVE-2026-65603: Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-22 · updated 2026-10-24
Weakness: CWE-269

Description

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.

Affected products

getgrav grav: before 3.8.12 — fixed in 3.8.12

How to fix

Upgrade to a fixed version: getgrav grav 3.8.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-65603 or the next vulnerability affects your stack