A critical authorization flaw (CVSS 9.8) in the Grav Login plugin allows an attacker holding api.users.write permission to clear login lockout counters on admin.super accounts, stripping brute-force protection from the site's highest-privilege users.
What Is It
Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. Because the handler never checks whether the caller's privileges match or exceed those of the account being unlocked, any user with the api.users.write permission can act against admin.super accounts.
The issue is classified as CWE-863 (Incorrect Authorization). VulnCheck, the disclosing party, assigned a CVSS 3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS 4.0 base score of 9.3 (CRITICAL).
Those vectors do not line up with the described attack. Both advisories state that the attacker must already hold the api.users.write permission, an authenticated, provisioned capability, yet the published 3.1 vector encodes PR:N (no privileges required). One of the two is wrong: either the vector should read PR:L (which would lower the 3.1 base score to roughly 8.8) or the prerequisite is narrower than the write-up suggests. Until NVD completes its analysis, treat the 9.8 and 9.3 figures as provisional and scope the risk from the described prerequisite rather than from the headline number.
Why It Matters
Login lockout counters are the control that makes password guessing against an admin account impractical. Clearing them on demand undermines that ceiling: an attacker who can repeatedly reset the counter turns a rate-limited target into a far less constrained one, and the account in question is admin.super, the highest-privilege role in the instance. How much this buys an attacker still depends on the target password's strength and on any rate limiting enforced upstream of the plugin, such as at a WAF or reverse proxy.
The escalation path matters as much as the mechanism. The flaw lets an actor operate against accounts above their own privilege level without holding equivalent permissions, which is exactly the boundary the unlock handler was supposed to enforce.
A search of the CISA Known Exploited Vulnerabilities catalog on 2026-08-25 returns no entry for CVE-2026-56710, so no KEV remediation due date or required action applies. That is an absence of public evidence, not evidence of absence; KEV reflects exploitation CISA has confirmed and chosen to publish, and low-volume or unreported activity against self-hosted Grav instances would not necessarily surface there. NVD lists the record as "Received" as of 2026-08-25, meaning analysis is still pending.
What's Vulnerable
- Vendor: getgrav
- Product: Grav (Login plugin)
- Affected versions: all versions before 1.0.16
- Fixed version: 1.0.16 and later
No CPE entries have been published for this record yet.
Patch Status
A fix is available. Version 1.0.16 is listed as unaffected in the vendor advisory; upgrade the Grav Login plugin to 1.0.16 or later. In the interim, audit which accounts hold api.users.write and confirm that grant is limited to trusted operators, and consider enforcing lockout or rate limiting at a layer the plugin cannot reset.
Sources
- GitHub Security Advisory (getgrav/grav), GHSA-985r-mpj8-5rqw: https://github.com/getgrav/grav/security/advisories/GHSA-985r-mpj8-5rqw
- VulnCheck Advisory; Grav Login Plugin Privilege Escalation via Unlock: https://www.vulncheck.com/advisories/grav-login-plugin-before-privilege-escalation-via-unlock
- NVD, CVE-2026-56710: https://nvd.nist.gov/vuln/detail/CVE-2026-56710
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog