VULNERABILITY INTELLIGENCE
CVE-2026-56710
CVSS score9.3 CRITICAL
EPSS probability0.51%
CISA KEVNot currently listed
Published2026-08-25
Last modified2026-10-12
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissions.
Weakness classification
- CWE-863: Incorrect Authorization