https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 21:19:13 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-65603 <p>The Grav Login plugin (grav-plugin-login) versions &lt;= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields (&#39;groups&#39;,&#39;access&#39;) from user-submitted form data before persisting them. When an administrator has added &#39;groups&#39; and/or &#39;access&#39; to plugins.login.user_registration.fields and the default &#39;regular&#39;/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.</p> <p>The Grav Login plugin (grav-plugin-login) versions &lt;= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields (&#39;groups&#39;,&#39;access&#39;) from user-submitted form data before persisting them. When an administrator has added &#39;groups&#39; and/or &#39;access&#39; to plugins.login.user_registration.fields and the default &#39;regular&#39;/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-65603 https://vulnerability.circl.lu/vuln/ghsa-38mm-mxvc-j98q <p>The Grav Login plugin (grav-plugin-login) versions &lt;= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields (&#39;groups&#39;,&#39;access&#39;) from user-submitted form data before persisting them. When an administrator has added &#39;groups&#39; and/or &#39;access&#39; to plugins.login.user_registration.fields and the default &#39;regular&#39;/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.</p> <p>The Grav Login plugin (grav-plugin-login) versions &lt;= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields (&#39;groups&#39;,&#39;access&#39;) from user-submitted form data before persisting them. When an administrator has added &#39;groups&#39; and/or &#39;access&#39; to plugins.login.user_registration.fields and the default &#39;regular&#39;/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.</p> https://vulnerability.circl.lu/vuln/ghsa-38mm-mxvc-j98q