CVE-2026-56710: Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav Login pluginto a version that resolves this vulnerability.Fixed in 1.0.16
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an account or other access context with the api.users.write permission. No equivalent admin.super permission is required to unlock an admin.super account.
What is the practical impact of exploitation?
The attacker can clear login lockout counters for admin.super accounts. This removes brute-force protection for those highest-privilege accounts, potentially enabling password-guessing attacks against them.
Are deployments using the Login plugin affected by default?
The available information identifies affected versions as those before 1.0.16, but it does not state whether api.users.write is granted in the default configuration. Exposure depends on whether an attacker can obtain that permission.
What should be done if upgrading is not immediately possible?
Restrict api.users.write to only fully trusted administrators and review accounts or API contexts that hold this permission. Monitor for unlock actions affecting admin.super accounts and investigate unexpected lockout-counter resets.