CVE-2026-65603 Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update
Low-privilege users can escalate to super-admin via profile update if specific fields are enabled, leading to admin access and potential remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-65603?
CVE-2026-65603 is a high-severity vulnerability in getgrav grav, published on 22 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.
Weakness: CWE-269
Which versions are affected by CVE-2026-65603?
How do I fix CVE-2026-65603?
No fix has been published for CVE-2026-65603 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-65603 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65603 exists.
Sources
Also known as GHSA-38mm-mxvc-j98q.