CVE-2026-65603

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.

• CWE-269

• https://github.com/getgrav/grav/security/advisories/GHSA-h33v-82r9-v8pm
• https://www.vulncheck.com/advisories/grav-login-plugin-privilege-escalation-via-profile-update
• https://github.com/getgrav/grav/security/advisories/GHSA-h33v-82r9-v8pm

Published

Jul 22, 2026

Last Modified

Jul 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65598n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU ra…7.5
• CVE-2026-65599n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a c…6.5
• CVE-2026-6560A security vulnerability has been detected in H3C Magic B0 u…8.8
• CVE-2026-65600Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v…5.3
• CVE-2026-65601Traefik versions 3.7.0 through 3.7.6 contain a namespace con…5.3
• CVE-2026-65602Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to…8.8
• CVE-2026-65604Skipper contains an incomplete fix for CVE-2026-50197 in whi…8.8
• CVE-2026-65605SiYuan before v3.7.2 contains a stored cross-site scripting …9.6
• CVE-2026-65606SiYuan before v3.7.2 contains a cross-site scripting vulnera…9.6
• CVE-2026-65607SiYuan before v3.7.2 contains a path traversal vulnerability…7.1
• CVE-2026-65608Grav versions >= 1.7.0 and before 2.0.9 contain a remote cod…8.8
• CVE-2026-6561A vulnerability was detected in EyouCMS up to 1.7.1. This is…4.7