CVE-2026-56710: Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock

Q: Who can exploit this issue?

An attacker needs an account or other access context with the api.users.write permission. No equivalent admin.super permission is required to unlock an admin.super account.

Q: What is the practical impact of exploitation?

The attacker can clear login lockout counters for admin.super accounts. This removes brute-force protection for those highest-privilege accounts, potentially enabling password-guessing attacks against them.

Q: Are deployments using the Login plugin affected by default?

The available information identifies affected versions as those before 1.0.16, but it does not state whether api.users.write is granted in the default configuration. Exposure depends on whether an attacker can obtain that permission.

Q: What should be done if upgrading is not immediately possible?

Restrict api.users.write to only fully trusted administrators and review accounts or API contexts that hold this permission. Monitor for unlock actions affecting admin.super accounts and investigate unexpected lockout-counter resets.

Published Aug 25, 2026

Updated

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissions.

Affected Software

1 affected component

grav/login<1.0.16

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grav Login plugin to a version that resolves this vulnerability.
Fixed in 1.0.16

Event History

Aug 25, 2026

CVE Published

via MITRE·01:30 AM

Data Sourced

via MITRE·01:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Sep 7, 58617

Event

via NVD·03:35 PM

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an account or other access context with the api.users.write permission. No equivalent admin.super permission is required to unlock an admin.super account.

What is the practical impact of exploitation?

The attacker can clear login lockout counters for admin.super accounts. This removes brute-force protection for those highest-privilege accounts, potentially enabling password-guessing attacks against them.

Are deployments using the Login plugin affected by default?

The available information identifies affected versions as those before 1.0.16, but it does not state whether api.users.write is granted in the default configuration. Exposure depends on whether an attacker can obtain that permission.

What should be done if upgrading is not immediately possible?

Restrict api.users.write to only fully trusted administrators and review accounts or API contexts that hold this permission. Monitor for unlock actions affecting admin.super accounts and investigate unexpected lockout-counter resets.

CVE-2026-56710: Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact of exploitation?

Are deployments using the Login plugin affected by default?

What should be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact of exploitation?

Are deployments using the Login plugin affected by default?

What should be done if upgrading is not immediately possible?