CVE-2026-59190: Grav Admin Plugin — IDOR Privilege Escalation via saveUser()
grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacker with admin.users permission can change the password of any user account, including the super administrator, by sending a direct POST request to /admin/user/{username}?task=save with data[password] because saveUser authorizes the caller's user-management permission but does not verify whether the caller may edit the target user. This issue is expected to be fixed in version 1.10.53.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
grav-plugin-adminto a version that resolves this vulnerability.Fixed in 1.10.53
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59190?
CVE-2026-59190 has a high severity rating of 8.7.
What is CVE-2026-59190?
CVE-2026-59190 is a vulnerability in the Grav Admin Plugin that allows an authenticated attacker with admin.users permission to change the password of any user account, including the super administrator.
How do I fix CVE-2026-59190?
To fix CVE-2026-59190, update the Grav Admin Plugin to version 1.10.53 or later.
Who is affected by CVE-2026-59190?
Users of the Grav Admin Plugin version 1.10.52 and earlier are affected by CVE-2026-59190.
What type of vulnerability is CVE-2026-59190?
CVE-2026-59190 is an IDOR (Insecure Direct Object Reference) vulnerability that allows privilege escalation.