The Grav Login plugin is missing a privilege check in its onApiUserListRowAction unlock handler. The flaw allows a user who has api.users.write permission to clear the login lockout counters on accounts that hold the admin.super role. Since lockout counters are meant to protect against brute‑force attacks, an attacker can effectively remove that protection and elevate privileges to the highest level.

This vulnerability impacts any installation of the Grav Login plugin in the Grav CMS provided by getgrav. Only versions earlier than 1.0.16 are vulnerable; all other components of Grav remain unaffected.

The flaw carries a CVSS score of 9.3, placing it in the high‑severity range. The EPSS score is not available and the vulnerability has not yet been listed in the CISA KEV catalog, indicating no confirmed public exploitation. Nonetheless, an attacker who can obtain api.users.write permission can exploit the vulnerability by invoking the unlock endpoint on an admin.super account, immediately bypassing brute‑force lockout protection and achieving administrative access.