Grav Login Plugin Privilege Escalation via Profile Update

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Grav Login plugin versions 3.8.11 and earlier suffer from a privilege escalation vulnerability (CWE-269) in the authenticated user profile self-update handler. Unlike the registration process which properly sanitizes input, the processUserProfile() function fails to strip privilege-related fields ('groups' and 'access') from user-submitted form data before persisting changes. This means authenticated users can arbitrarily modify their own account permissions and group memberships, effectively escalating their privileges within the system. The vulnerability affects installations using the default DataUser backend where administrators have exposed these fields in the user registration form configuration. Any authenticated attacker can exploit this to gain administrative access or assume roles they should not possess, making it a critical issue for multi-user Grav deployments.

Casky's 224 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns associated with this privilege escalation under MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would observe detection patterns including: suspicious profile update requests containing 'groups' or 'access' parameters from non-administrative accounts, unauthorized privilege field modifications in form submissions, and unexpected user account permission changes without corresponding administrative actions. The platform's skills would flag inconsistencies between the registration handler's input validation logic and the profile update handler's missing sanitization, identifying the architectural flaw. Additionally, Casky would highlight post-exploitation indicators such as regular users suddenly appearing in elevated group memberships or gaining access levels inconsistent with their roles, enabling security teams to identify compromised accounts and trace lateral movement stemming from privilege escalation attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-65603.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-65603

Casky has 224 skills that investigate the attack patterns behind CVE-2026-65603. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn