Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck
CVE-2026-56710Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
Critical 9.8
In plain English
A critical-severity incorrect authorization in grav from getgrav. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 56.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissions.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-985r-mpj8-5rqw) vendor-advisory
- VulnCheck Advisory: Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock third-party-advisory