CVE-2026-56710 Overview
CVE-2026-56710 is an authorization flaw [CWE-863] in the Grav Login plugin affecting versions before 1.0.16. The onApiUserListRowAction unlock handler fails to validate the target account's privilege level before clearing login lockout counters. An attacker holding the api.users.write permission can reset brute-force lockout state on admin.super accounts without possessing equivalent privileges. This removes rate-limiting protection from the highest-privilege administrative accounts, enabling sustained brute-force attempts against Grav administrator credentials.
Critical Impact
A lower-privileged API user can strip brute-force protection from super-admin accounts, exposing them to unlimited credential-guessing attacks over the network.
Affected Products
- Grav CMS Login plugin versions prior to 1.0.16
- Grav installations exposing the admin API to users with api.users.write permission
- Deployments relying on the plugin's built-in lockout mechanism as brute-force mitigation
Discovery Timeline
- 2026-08-25 - CVE-2026-56710 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-56710
Vulnerability Analysis
The Grav Login plugin implements an account lockout mechanism that tracks failed authentication attempts and blocks further login attempts after a threshold. Administrators can clear these counters through the user list interface, which invokes the onApiUserListRowAction handler. This handler exposes an unlock action reachable by any authenticated user holding the api.users.write capability.
The handler performs a permission check on the caller but does not verify that the caller's privilege level meets or exceeds the target account's privilege level. As a result, a user with only api.users.write can invoke the unlock action against accounts holding admin.super, the highest privilege scope in Grav. The vulnerability is a horizontal-to-vertical privilege escalation because the acting account modifies security state on a higher-privileged account.
Root Cause
The root cause is a missing authorization check [CWE-863] in the unlock code path. The handler treats api.users.write as sufficient authority to mutate lockout state on any user record, regardless of the target's role. Grav's permission model expects sensitive actions against admin.super accounts to require equivalent privilege, but the unlock handler does not enforce that invariant.
Attack Vector
Exploitation requires network access to the Grav admin API and an authenticated session holding api.users.write. The attacker submits an unlock request targeting an admin.super account. The handler clears the failed-login counter and lockout timestamp, restoring the account to an unlocked state. The attacker can then resume password guessing against that account, repeating the unlock request to defeat subsequent lockouts. Chained with a weak or leaked password, this yields full super-admin access.
No verified proof-of-concept code is publicly available. Refer to the GitHub Security Advisory GHSA-985r-mpj8-5rqw and the VulnCheck Advisory on Grav Plugin for technical details.
Detection Methods for CVE-2026-56710
Indicators of Compromise
- Repeated API calls to the user list row action endpoint invoking the unlock action against admin.super accounts
- Login failure spikes against super-admin accounts followed by an unlock event and additional failures
- Unlock actions performed by accounts that are not themselves admin.super
Detection Strategies
- Audit Grav admin logs for onApiUserListRowAction invocations and correlate the acting user's role with the target user's role
- Alert when any account without admin.super clears lockout counters on an admin.super account
- Baseline expected unlock frequency and flag anomalous spikes, especially adjacent to failed-login bursts
Monitoring Recommendations
- Forward Grav web server and application logs to a centralized log platform for retention and correlation
- Monitor authentication failure counts per account and generate alerts when repeated unlock-then-fail sequences occur
- Track privilege assignments so that any new api.users.write grant is reviewed against least-privilege policy
How to Mitigate CVE-2026-56710
Immediate Actions Required
- Upgrade the Grav Login plugin to version 1.0.16 or later on all Grav installations
- Review all accounts holding api.users.write and revoke the permission where it is not strictly required
- Rotate credentials for admin.super accounts and enforce strong, unique passwords with multi-factor authentication where supported
- Inspect admin API logs for prior unlock actions targeting super-admin accounts by non-super users
Patch Information
The fix is included in Grav Login plugin version 1.0.16. The upstream advisory is published at GitHub Security Advisory GHSA-985r-mpj8-5rqw. Update through the Grav plugin manager or by pulling the fixed release from the plugin repository.
Workarounds
- Restrict api.users.write to trusted administrators pending the upgrade
- Block network access to the Grav admin interface from untrusted networks using a reverse proxy or web application firewall
- Disable API-based user management features until the plugin is patched if operational constraints allow
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
