CVE-2026-59190CWE-639

Grav Admin Plugin — IDOR Privilege Escalation via saveUser()

High · published July 10, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacker with admin.users permission can change the password of any user account, including the super administrator, by sending a direct POST request to /admin/user/{username}?task=save with data[password] because saveUser authorizes the caller's user-management permission but does not verify whether the caller may edit the target user. This issue is expected to be fixed in version 1.10.53.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00364 · 29.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-10T16:33Z
EPSS history
Timeline
  • 10 JUL 16:33Z
    Grav Admin Plugin — IDOR Privilege Escalation via saveUser()
    cvelistv5