Privilege Escalation Vulnerability in Grav Login Plugin by Grav

CVE-2026-65603

What is CVE-2026-65603?

The Grav Login plugin (grav-plugin-login) up to version 3.8.11 is vulnerable to a privilege escalation flaw in its profile self-update handler. The vulnerability arises because the authenticated user profile update function does not properly sanitize user-submitted data. Consequently, low-privilege users can exploit this by sending crafted data to elevate their privileges to super-admin. This can lead to unauthorized access to admin functions, including full control over the admin panel, potential remote code execution, and misuse of Twig template evaluation. The issue has been resolved in version 3.8.12.

References