Grav CVE-2026-59190

We need to produce a JSON object with the specified fields. The input includes CVE-2026-59190, description, CVSS 4.0 vector, CWE, EPSS, CPE, tags, references, source code diff, etc. We must synthesize the data, cross-reference, and output. All fields must be plain text strings.

Let's extract key information:

• Product: "grav-plugin-admin" is the specific product. It's an admin plugin for Grav CMS. The primary product name should be "Grav Admin Plugin" or "Grav Plugin Admin"? The description says "grav-plugin-admin is an HTML user interface...". The affected product is this plugin. So "grav-plugin-admin" is fine. But the CPE says "getgrav:grav:*" which is the base Grav CMS. However, the vulnerability is in the admin plugin. The product_name should be "Grav Admin Plugin". Simpler: "grav-plugin-admin". I'll use "Grav Admin Plugin" as the product name.
• Summary: Must be original, not just paraphrase description. Impact: authenticated attacker with admin.users permission can change password of any user including superadmin, leading to privilege escalation. Mention KEV status? KEV not in input (no KEV field). So not actively exploited. POC exists? SSVC says "Exploitation: poc" so publicly available exploit code exists. EPSS 0.21% low. So summary: Privilege escalation in Grav Admin Plugin 1.10.52 and earlier allows authenticated user with user management permission to reset any account password via crafted POST request, bypassing target user permission check. Public proof-of-concept exists. No evidence of active exploitation.
• Technical context: Affected component is the saveUser method in the AdminController of the Grav admin plugin. It's an authorization bypass (CWE-639: Authorization Bypass Through User-Controlled Key) because it checks if the caller has permission to manage users but doesn't verify if they can edit the specific target user (like superadmin). The fix adds a check: if the caller is not a super admin and tries to edit a super admin account, block. T