Privilege Escalation via profile self-update in Grav Login plugin (CVE-2026-65603)

The Grav Login plugin versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler. Unlike the registration handler, it does not strip privilege fields ('groups','access') from user-submitted data before persisting them, allowing a low-privilege authenticated user to escalate to super-admin by posting crafted form data. This can lead to full site/host takeover via admin panel access, scheduler abuse, and Twig evaluation. Affected versions: - <= 3.8.11 We recommend updating to: 3.8.12. CVSS 8.7 · our assessment: this_week Reference: https://github.com/getgrav/grav/security/advisories/GHSA-h33v-82r9-v8pm Details: https://vuln.today/cve/CVE-2026-65603