Which versions of Grav are affected by CVE-2026-65603?

Grav CMS Login plugin versions 3.8.11 and earlier contain a privilege escalation vulnerability that allows authenticated users to promote their own accounts to super-admin status.. A patch is available.

How to fix or mitigate CVE-2026-65603?

Within 24 hours: inventory all systems running grav-plugin-login <= 3.8.11 and map which instances permit low-privilege user self-registration or profile updates. Within 7 days: restrict access to the user profile update endpoint (update_user task) at the application or network layer to administrative users only, or disable user self-profile editing entirely if business process allows. Within 30 days: prepare and test an upgrade path; monitor the Grav plugin marketplace and vendor advisories for patch release, and schedule deployment to a patched version as soon as available.

Grav CVE-2026-65603

Q: What is the CVSS score of CVE-2026-65603?

CVE-2026-65603 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47647 HIGH

Improper Privilege Management (CWE-269)

2026-07-22 VulnCheck

GHSA-38mm-mxvc-j98q

Privilege Escalation Grav Getgrav

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 13:02 EUVD

Analysis Generated

Jul 22, 2026 - 12:21 vuln.today

CVE Published

Jul 22, 2026 - 11:21 cve.org

HIGH 8.7

DescriptionCVE.org

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.

AnalysisAI

Privilege escalation in the Grav CMS Login plugin (grav-plugin-login) <= 3.8.11 lets a low-privilege authenticated user promote their own account to super-admin by injecting privilege fields into a profile self-update request. The flaw lives in processUserProfile() (the update_user task), which — unlike the registration handler — fails to strip 'groups' and 'access' from user-submitted form data before persisting it. There is no public exploit identified at time of analysis and it is not in CISA KEV, but exploitation is trivial once the exposing configuration is present, and gaining super-admin unlocks admin panel access, scheduler-driven RCE, and Twig evaluation.