CVE-2026-56710 in Login Plugin
Summary
by MITRE • 08/25/2026
Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/25/2026
The Grav Login plugin is a widely utilized authentication and user management extension for the Grav content management system, designed to handle secure access control through features such as password hashing, session management, and account lockout mechanisms. In versions prior to 1.0.16, a critical authorization flaw exists within the onApiUserListRowAction handler responsible for processing unlock actions against locked user accounts. This vulnerability stems from an improper implementation of Access Control List checks during the execution of administrative API endpoints. Specifically, when an authenticated user with api.users.write permissions attempts to clear the login lockout counter for another account, the system fails to verify whether the target account possesses elevated privileges that exceed those of the initiating requestor.
This technical flaw allows a lower-privileged administrator or any entity possessing write access to user data via the API to bypass security controls intended for high-level accounts. The primary operational impact is the removal of brute-force protection mechanisms from admin.super accounts, which represent the highest privilege level within the Grav ecosystem. By clearing lockout counters without authorization, an attacker can effectively neutralize a key defense-in-depth measure designed to prevent automated credential stuffing and dictionary attacks against critical administrative users. This undermines the integrity of the authentication system and exposes sensitive backend functionalities to unauthorized access attempts that would otherwise be throttled or blocked by standard security policies.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, as it involves an actor obtaining privileges they are not explicitly authorized to exercise relative to the target resource. Furthermore, in the context of the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts and potentially aids in T1110 Brute Force by removing rate-limiting controls that would otherwise impede such attacks. The lack of vertical privilege checking allows for a form of horizontal or vertical escalation depending on the initial foothold, enabling attackers to maintain persistent access attempts against high-value targets without triggering account lockouts.
Mitigation strategies primarily involve upgrading the Grav Login plugin to version 1.0.16 or later, where this authorization check has been corrected to ensure that only users with equivalent or higher privilege levels can unlock accounts of a given sensitivity tier. For environments unable to immediately patch, administrators should restrict api.users.write permissions strictly to trusted super-administrator roles and monitor API logs for unusual patterns of account unlocking activity. Additionally, implementing network-level rate limiting on authentication endpoints provides an additional layer of defense against brute-force attempts even if the application-level lockout mechanism is compromised. Regular audits of user permission assignments are also recommended to ensure that write access does not inadvertently extend to sensitive administrative functions beyond intended boundaries.