CVE-2026-59190

unknowncovered by 1 sourcefirst seen 2026-07-10

grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacker with admin.users permission can change the password of any user account, including the super administrator, by sending a direct POST request to /admin/user/{username}?task=save with data[password] because saveUser authorizes the caller's user-management permission but does not verify whether the caller may edit the target user. This issue is expected to be fixed in version 1.10.53.

⚡ Watch CVE-2026-59190

Get an email if CVE-2026-59190 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

unknownCVE-2026-59190: grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create a…nvd · 2026-07-10

External references

NVD record for CVE-2026-59190

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-59190 status](https://www.csirts.com/badge/CVE-2026-59190)](https://www.csirts.com/cve/CVE-2026-59190)