A privilege-related vulnerability in the Grav Login plugin allows unauthorized users to disable brute-force protections for administrative accounts.

The Grav Login plugin fails to perform necessary capability checks within the onApiUserListRowAction function. This allows an attacker with existing lower-level API permissions to clear lockout counters for admin.super accounts, effectively bypassing brute-force security controls.

By disabling brute-force protections on administrative accounts, an attacker significantly increases the success probability of credential-stuffing or brute-force attacks. This vulnerability effectively lowers the barrier for full administrative takeover of the Grav CMS environment.

Immediate Action: Update the Grav Login plugin to version 1.0.16 or higher immediately to resolve the authorization flaw.

Proactive Monitoring: Audit user activity logs for unusual API calls or repeated attempts to clear lockout statuses for administrative accounts.

Compensating Controls: Implement multi-factor authentication (MFA) on all administrative accounts to mitigate the risk of password-based attacks, even if brute-force protection is bypassed.

Public Exploit Available: No confirmed public exploit available.

While an attacker requires some level of API access to leverage this flaw, it represents a significant risk to account security. System administrators should verify their current plugin version and apply the 1.0.16 update to ensure that robust brute-force protections remain active for all users.