In Grav Admin Plugin 1.10.52 and earlier an authenticated user who holds the admin.users permission can change the password of any user, including the super administrator, by sending a direct POST request to /admin/user/{username}?task=save with the data[password] field. The handler saveUser authorizes the caller's user-management permission but does not verify that the caller is permitted to edit the target account, resulting in an Insecure Direct Object Reference that enables privilege escalation and undermines account security.

The vulnerability affects installations of the Grav Admin Plugin produced by getgrav, specifically any version 1.10.52 or earlier. Users that have the admin.users permission can trigger the flaw. Versions 1.10.53 and newer contain the fix.

The flaw carries a CVSS score of 8.7, signifying high severity. Exploitation only requires an authenticated user with the admin.users permission; the attacker can send a POST request to /admin/user/{username}?task=save with a data[password] field to change any user's password, including that of the super administrator. The EPSS score is <1%, indicating a very low but non-zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, so the overall risk remains high for affected installations with admin.users privileges.