CVE-2026-65603

creationtimestamp| type| source ---|---|--- 2026-07-22 12:00:35+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mrabll3cy72g 2026-07-22 12:00:39+00:00| seen| https://infosec.exchange/users/offseq/statuses/116963516971345867 2026-07-22 13:14:28+00:00| seen|...

CVE-2026-65603 Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...