CVE-2026-65603

Name of the Vulnerable Software and Affected Versions Grav Login plugin (grav-plugin-login) versions prior to 3.8.12

Description A privilege escalation flaw exists in the authenticated profile self-update handler processUserProfile() (the update user task). The handler fails to strip privilege fields such as groups and access from user-submitted form data before saving them. If an administrator has added groups and/or access to plugins.login.user registration.fields and the default regular/DataUser account backend is active, a low-privilege authenticated user can send crafted profile form data (e.g., access[admin][super]=true) to gain super-admin privileges. This allows unauthorized access to the admin panel, scheduler abuse leading to Remote Code Execution (RCE), and Twig evaluation.

Recommendations Update to version 3.8.12.