CVE-2026-65603 in Login Plugin
Summary
by MITRE • 07/22/2026
The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability identified in the Grav Login plugin affects versions 3.8.11 and earlier, presenting a critical privilege escalation flaw that undermines the authentication system's integrity. This issue resides within the authenticated profile self-update handler known as processUserProfile() or the update_user task, which processes user-submitted form data for profile modifications. The flaw stems from insufficient input validation and sanitization practices where the system fails to properly filter out privileged fields during user profile updates, creating a direct pathway for unauthorized privilege elevation.
The technical implementation of this vulnerability exploits the difference in security handling between two distinct code paths within the plugin's authentication mechanism. While the registration handler correctly strips privilege-related fields such as 'groups' and 'access' from submitted form data before persisting changes, the profile update handler does not perform this critical sanitization step. When administrators configure the plugin to include 'groups' and/or 'access' in the user_registration.fields configuration, these fields become accessible to authenticated users through the profile update interface. This misconfiguration creates an attack surface where low-privileged users can manipulate form data to inject administrative privileges directly into their own accounts.
The operational impact of this vulnerability extends far beyond simple privilege escalation, creating a comprehensive attack vector that enables full administrative control over affected Grav installations. An attacker who successfully exploits this flaw gains super-administrator privileges, which provides complete access to the admin panel and all associated functionality. This elevated access level allows for scheduler abuse and potential remote code execution through the exploitation of the administration interface's capabilities. Additionally, the vulnerability enables Twig template evaluation, which can be leveraged to execute arbitrary code on the server, transforming a simple privilege escalation into a full system compromise.
The root cause of this vulnerability aligns with CWE-264, which defines "Permissions, Privileges, and Access Controls" as a category of security weaknesses where improper access control mechanisms allow unauthorized users to gain elevated privileges. This weakness specifically manifests as a failure to properly sanitize user-supplied data before processing it in privileged contexts, creating an authorization bypass that directly violates the principle of least privilege. The vulnerability also maps to ATT&CK technique T1078 which covers "Valid Accounts" and T1543 which addresses "Create or Modify System Process," as the compromised account can be used to establish persistent access and potentially modify system processes through the admin panel.
Mitigation strategies for this vulnerability require immediate implementation of the patched version 3.8.12, which properly sanitizes user-submitted data before persisting it to user accounts. Organizations should also conduct comprehensive audits of their Grav plugin configurations to ensure that privilege fields are not inadvertently exposed through user registration forms. Security administrators should implement regular monitoring of user account changes and access logs to detect unauthorized privilege escalation attempts. Additionally, organizations should consider implementing multi-factor authentication for administrative accounts, network segmentation to limit access to critical systems, and regular security assessments of third-party plugins to identify similar vulnerabilities in other components of their web applications. The fix implemented in version 3.8.12 demonstrates proper input validation and sanitization practices that ensure user-submitted data cannot be used to manipulate privileged fields within the system's authentication framework.