grav-plugin-admin CVE-2026-59190

Exploitation requires prior authentication to the Grav admin panel with an account that holds the admin.users permission - a subordinate administrative role used for user management below super-admin level. Without admin.users rights, the endpoint returns an authorization error. The target Grav deployment must also have at least one such subordinate admin account, a common configuration in multi-operator sites. The request is sent over the network to the Grav admin panel (AV:N); no user interaction from the victim is required. Super-admin accounts are unaffected as callers since they already possess the necessary rights legitimately. No special non-default configuration is required beyond the presence of a subordinate admin role - exploitation is limited primarily by the need to first compromise or be an admin.users-level account.

Real-world risk is meaningful within any multi-operator Grav deployment despite a low EPSS score of 0.21% (12th percentile), which reflects limited opportunistic scanning rather than low impact potential. The CVSS 4.0 score of 8.7 with PR:L correctly captures the authenticated prerequisite - the attacker must already hold admin.users rights - which bounds the at-risk population to deployments with subordinate admin roles. Within that population, exploitation is trivially simple: one HTTP POST, no brute force, no race condition (SSVC automatable: no is debatable given the single-step exploit path, though it may reflect the need for prior credential access). Even a mid-sized municipal IT team in sopot that delegates day-to-day user management to junior administrators should treat this as urgent, because any such operator can silently reset the super-admin password and assume full CMS control. SSVC technical impact is rated total, consistent with full administrative takeover. The absence of KEV listing and the low EPSS suggest mass opportunistic exploitation is unlikely at time of analysis; however, the exploit mechanics are effectively disclosed by the GHSA advisory and commit diff, making targeted abuse straightforward for any insider or attacker who has compromised a subordinate admin account.

An attacker who has phished or reused credentials for a Grav account with admin.users rights authenticates to the admin panel and submits a POST to /admin/user/admin?task=save with data[password]=attacker_chosen_value. The saveUser() method applies the password change to the super-admin account without any privilege-tier check, and the attacker then logs in as super administrator with full CMS control. The exploit path is effectively documented in the public GHSA advisory and commit diff.