CVE-2026-56710

Name of the Vulnerable Software and Affected Versions Grav Login plugin versions prior to 1.0.16

Description Insufficient validation of the target account privilege level occurs in the onApiUserListRowAction unlock handler. An attacker possessing api.users.write permission can clear login lockout counters on admin.super accounts. This action removes brute-force protection from the highest-privilege accounts without the attacker needing equivalent administrative permissions.

Recommendations Update Grav Login plugin to version 1.0.16 or later.