CVE-2026-56710
CriticalCVSS 9.8Summary
Grav Login plugin before 1.0.16 fails to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts.
Risk Assessment
This could allow an attacker to perform brute-force attacks on administrator accounts without equivalent permissions, potentially leading to account takeover.
Recommendation
Update the Grav Login plugin to version 1.0.16 or later. Restrict api.users.write permission to trusted users only.
Original NVD description (English source)
Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissions.