Security readout for executives and security teams
Plain-English summary
A flaw in Grav’s Login plugin before 1.0.16 lets an attacker with user-writing API permission unlock the most privileged administrator accounts. This removes their login lockout protection, making password attacks easier. The flaw does not itself prove account takeover, but it weakens a critical defense around admin.super accounts.
Executive priority
Treat remediation as urgent for internet-accessible or broadly delegated Grav administration environments. Prioritize upgrading and permission review, then investigate unexpected privileged-account unlocks. Current sources do not demonstrate exploitation in the wild.
Technical view
The onApiUserListRowAction unlock handler does not validate the target account’s privilege level. A caller able to perform the affected user-write API action can clear lockout counters for admin.super accounts without equivalent administrative authority. This is classified as CWE-863, incorrect authorization.
Likely exposure
Exposure is limited to Grav deployments using Login plugin versions earlier than 1.0.16. Risk is greatest where the affected API is reachable and api.users.write is granted to less-trusted identities. The bundle’s affected-version data is ambiguously formatted, so inventories should confirm versions against the vendor advisory.
Exploitation context
The bundle does not establish active exploitation, and the CVE is not identified as KEV. The description requires api.users.write permission, although the supplied CVSS vector states PR:N. This inconsistency should be resolved through vendor guidance before assuming unauthenticated exploitation.
Researcher notes
The documented primitive clears brute-force lockout counters; it does not directly demonstrate authentication bypass or privilege acquisition. Authorization boundaries around api.users.write, API reachability, and audit logging determine practical risk. The supplied 9.8 CVSS vector conflicts with the stated permission prerequisite and warrants vendor confirmation.
Mitigation direction
- Update the Grav Login plugin to version 1.0.16 or later.
- Review vendor guidance for any additional configuration or access-control changes.
- Restrict api.users.write permission to identities that genuinely require it.
- Limit network access to Grav administrative and user-management APIs.
- Monitor privileged accounts for unexpected unlocks and repeated authentication attempts.
Validation and detection
- Inventory Grav deployments and record installed Login plugin versions.
- Confirm every affected installation runs Login plugin 1.0.16 or later.
- Review assignments of api.users.write and remove unnecessary grants.
- Check logs for unexpected unlock actions targeting admin.super accounts.
- Verify lockout protections still operate for highest-privilege accounts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-56710 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-985r-mpj8-5rqw)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: Grav Login Plugin before 1.0.16 Privilege Escalation via UnlockCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.