Executive brief
The Grav Admin Plugin, which provides a web interface for managing Grav CMS websites, contains a security flaw that allows certain administrative users to take over any other account. A user with basic user-management permissions can reset the password of the super administrator without knowing the current password. This allows an attacker to gain full control over the website, including the ability to modify all content, configurations, and potentially execute malicious code.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the `saveUser()` method of `AdminController.php` in the Grav Admin Plugin. While the application checks if the caller has `admin.users` permissions, it fails to verify if the caller has sufficient privileges to modify the specific target user (e.g., a super administrator). An attacker can send a direct POST request to `/admin/user/{username}?task=save` containing a new password in the `data[password]` field. Because `cleanUserPost()` does not strip the raw password field and the backend does not require current password verification for this task, a lower-privileged admin can achieve full account takeover of a super admin. The issue is addressed in version 1.10.53 by implementing a target-ownership check.
Affected products
- getgrav Grav Admin Plugin >= 1.2.11, <= 1.10.52
Timeline
- 2026-06-20: patched: Version 1.10.53 released to fix the vulnerability.
- 2026-06-22: advisory: GitHub Security Advisory GHSA-p97c-g455-q447 published.
- 2026-07-10: disclosed: CVE-2026-59190 published to the NVD.