CVE-2026-65603: Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update

Vulnerability summary

CVE-2026-65603 is a high (CVSS 8.8) Improper Privilege Management vulnerability in getgrav grav. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.3% of scored vulnerabilities.

Timeline

1. 22-07-2026
   PublishedVulnerability first disclosed.
2. 22-07-2026
   Last modifiedVulnerability information updated.

Description

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.