Authorization Bypass in Grav Login Plugin

Grav Login plugin versions before 1.0.16 are vulnerable to an improper authorization flaw (CWE-863) within the onApiUserListRowAction unlock handler. This vulnerability enables an attacker who already possesses api.users.write permissions to clear login lockout counters for accounts with admin.super privileges. By successfully resetting these counters, an attacker can effectively neutralize brute-force protection mechanisms for the highest-privilege accounts in the system. This significantly increases the risk of successful account takeover via automated credential-guessing attacks. Defenders should prioritize updating the Grav Login plugin to version 1.0.16 or later to enforce proper privilege validation during the unlock process.

Impact

Successful exploitation of this vulnerability allows an attacker to bypass existing security controls intended to prevent brute-force attacks against administrative accounts. By resetting lockout counters, attackers can maintain persistent attempts to compromise administrative credentials without the risk of the account being locked, potentially leading to full administrative compromise of the Grav instance.

Recommendation

• Upgrade the Grav Login plugin to version 1.0.16 or later immediately.
• Audit accounts with the api.users.write permission to ensure that only authorized users or services maintain this capability.
• Review web server logs for suspicious API requests directed at the onApiUserListRowAction handler that correlate with repeated failed login attempts against administrative users.