CVE-2026-59190

HIGH 8.7 PoC AVAILABLE ALL-YEARS

Published 2026-07-10 · Last modified 2026-07-10 · GitHub_M · NVD: Deferred

grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacker with admin.users permission can change the password of any user account, including the super administrator, by sending a direct POST request to /admin/user/{username}?task=save with data[password] because saveUser authorizes the caller's user-management permission but does not verify whether the caller may edit the target user. This issue is expected to be fixed in version 1.10.53.

EXPLOIT AVAILABLE

Public exploit or PoC code exists. The barrier to attack is reduced — watch closely.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 12th percentile

○ In CISA KEV● Public exploit / PoC◆ SSVC: exploitation poc, automatable no

Impact if exploited

8.7CVSS 4.0 · HIGH · CNA

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

What an attacker needs

✓Access: Reachable over the network — no local access needed
⚠Privileges: Requires a low-privilege account
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable
✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

reference https://github.com/getgrav/grav/security/advisories/GHSA-p97c-g455-q447
github-search https://github.com/search?q=%22CVE-2026-59190%22&type=repositories

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-59190/poc.jsonMachine-readable PoC index for this CVE (for automation).

For defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-59190/poc.json

Affected

Vendors Getgrav

Products Grav

Weakness (CWE)

CWE-639: : Authorization Bypass Through User-Controlled Key

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

All CVSS metrics

HIGH 8.7 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
HIGH 8.7 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Exploits & PoC

https://github.com/getgrav/grav/security/advisories/GHSA-p97c-g455-q447 x_refsource_CONFIRMexploit

Technical & other

https://github.com/getgrav/grav-plugin-admin/commit/88f7ce8e50324472f492965caa42fb709a4f791a x_refsource_MISC

Sources: NVD · CVE.org · EPSS