An authenticated privilege escalation vulnerability in the Grav Login plugin allows users to gain unauthorized access to administrative functions.

This is a privilege management vulnerability (CWE-269) that occurs when updating user profiles. It allows an authenticated user to modify their own privilege level beyond what is permitted, effectively escalating their access rights.

The CVSS score of 8.8 reflects the high risk of a full administrative compromise of the Grav installation. Unauthorized access to administrative functions can lead to total system takeover, unauthorized content modification, and potential data exfiltration. Given that this is a privilege escalation, it poses a severe threat to the integrity of the entire web application.

Immediate Action: Update the Grav Login plugin to version 3.8.12 or higher immediately.

Proactive Monitoring: Audit user account changes and administrative logs for any unexpected elevation of user roles or unauthorized profile updates.

Compensating Controls: Implement an administrative firewall policy that restricts access to the backend management interface to trusted IP addresses only.

Public Exploit Available: Unknown.

Immediate patching is required to prevent potential privilege escalation attacks. In addition to updating, perform a thorough review of all user accounts to ensure no unauthorized administrative accounts have been created or modified during the period the system was vulnerable.