CVE-2026-59190 is an authorization bypass vulnerability in grav-plugin-admin (part of the Grav CMS) affecting versions up to 1.10.52. An authenticated attacker with admin.users permission can exploit this flaw by sending a crafted POST request to /admin/user/{username}?task=save with a password change payload. The root cause is that the saveUser method checks only for user-management permission but fails to verify whether the caller is authorized to modify the specific target user account. This allows unauthorized password changes, including for the super administrator account. The vulnerability is tracked as CWE-639 (Authorization Bypass Through User-Controlled Key). A fix is expected in version 1.10.53.

An attacker with valid admin.users permission can change the password of any user account, including the highest privileged super administrator account. This could lead to full account takeover and complete compromise of the Grav CMS instance. The vulnerability has a high CVSS 4.0 score of 8.7, reflecting its potential for significant impact on confidentiality, integrity, and availability.

A fix is expected in Grav version 1.10.53. Until the patch is applied, restrict admin.users permissions to fully trusted users only. Monitor for suspicious password change requests targeting user accounts. Check the vendor advisory or official Grav project channels for the release of version 1.10.53 and apply the update promptly once available.