CVE-2026-56710CWE-863broken-access-control

CVE-2026-56710

Critical · published August 25, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissions.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00512 · 42.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-25T06:16Z
References (2)
https://github.com/getgrav/grav/security/advisories/GHSA-985r-mpj8-5rqw · [email protected]https://www.vulncheck.com/advisories/grav-login-plugin-before-privilege-escalation-via-unlock · [email protected]
EPSS history
Timeline
  • 26 AUG 08:15Z
    EPSS moved — → 0%
    epss
  • 25 AUG 01:30Z
    Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
    cvelistv5