The Grav Login plugin contains a flaw in the profile self‑update handler that allows an authenticated user to set privilege fields. Because the handler does not remove the ‘groups’ and ‘access’ fields from the form data before saving, a low‑privilege user can submit crafted data that gives the user super‑admin rights. This elevation gives full admin panel access and enables potentially dangerous operations such as scheduler abuse that can lead to remote code execution and Twig evaluation.

The vulnerability is present in Grav 3.8.11 and earlier, specifically the getgrav:grav plugin. The flaw applies when administrators have added privilege fields to the login user registration configuration and the default regular/DataUser backend is in use. Clients running a later version are not affected.

The CVSS score of 8.7 indicates high severity. The EPSS score is < 1%, indicating a very low probability of exploitation, but this metric does not imply the vulnerability is safe; it simply reflects current observed exploitation activity. The flaw requires an authenticated session but does not need elevated privileges, making it easily reachable for many users. The vulnerability is not listed in the CISA KEV catalog, yet its impact makes it a high‑risk issue. Exploitation would involve sending a POST request to the profile update endpoint with privileged fields set to true, assuming the user still has an active session.