EUVD-2026-47647
GHSA-38mm-mxvc-j98q
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Privilege escalation in the Grav CMS Login plugin (grav-plugin-login) <= 3.8.11 lets a low-privilege authenticated user promote their own account to super-admin by injecting privilege fields into a profile self-update request. The flaw lives in processUserProfile() (the update_user task), which — unlike the registration handler — fails to strip 'groups' and 'access' from user-submitted form data before persisting it. There is no public exploit identified at time of analysis and it is not in CISA KEV, but exploitation is trivial once the exposing configuration is present, and gaining super-admin unlocks admin panel access, scheduler-driven RCE, and Twig evaluation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Grav gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.
Executive ViewAI
Grav CMS Login plugin versions 3.8.11 and earlier contain a privilege escalation vulnerability that allows authenticated users to promote their own accounts to super-admin status. Exploitation requires no external actions and leads directly to administrative panel access, code execution via the task scheduler, and template injection-creating a path to full system compromise. Organizations running affected versions should treat this as critical if user registration is enabled or existing low-privilege users have access.
Within 24 hours: inventory all systems running grav-plugin-login <= 3.8.11 and map which instances permit low-privilege user self-registration or profile updates. Within 7 days: restrict access to the user profile update endpoint (update_user task) at the application or network layer to administrative users only, or disable user self-profile editing entirely if business process allows. Within 30 days: prepare and test an upgrade path; monitor the Grav plugin marketplace and vendor advisories for patch release, and schedule deployment to a patched version as soon as available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable or restrict access to user profile self-update functionality; (2) Limit account creation permissions to administrators only; (3) Monitor user database for unauthorized privilege escalations (groups, access field changes); (4) Implement role-based access control at the application layer to prevent execution of privileged scheduler tasks; (5) Subscribe to Grav security bulletins for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Server-side template injection (SSTI) in Grav (getgrav/grav) prior to 1.8.0-beta.27 allows an authenticated attacker hol
Broken access control in Grav CMS (CWE-285) before 1.8.0-beta.27 lets an authenticated editor-level user escalate their
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to wri
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users perm
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past
Server-side request forgery (SSRF) in Grav CMS versions prior to 1.7.49.5 allows remote authenticated attackers to make
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary
Exploit-DB