Skip to content
Threat Feed
Subscribe

Product

Grav Login Plugin (Grav-Plugin-Login) <= 3.8.11

1 brief RSS
critical advisory

Grav Login Plugin Privilege Escalation (CVE-2026-65603)

A critical privilege escalation vulnerability, CVE-2026-65603, exists in the Grav Login plugin (grav-plugin-login) versions up to and including 3.8.11, allowing an authenticated low-privilege user to exploit a flaw in the `processUserProfile()` handler to bypass privilege stripping and escalate to super-admin, enabling admin panel access, remote code execution, and Twig evaluation.

Grav Login plugin privilege-escalation web-vulnerability grav cms
2t 1c