CVE-2026-65603 is a privilege escalation vulnerability in the Grav Login plugin (grav-plugin-login) versions <= 3.8.11. The vulnerability arises because the processUserProfile() handler, responsible for authenticated profile self-updates, fails to strip privilege fields such as 'groups' and 'access' from user-submitted form data before saving. When an administrator has configured these fields in plugins.login.user_registration.fields and the default 'regular'/DataUser backend is used, a low-privilege authenticated user can craft profile update requests to escalate privileges to super-admin. This escalation grants access to the admin panel, scheduler abuse leading to remote code execution, and Twig template evaluation. The vulnerability is resolved in version 3.8.12.

Exploitation allows a low-privilege authenticated user to escalate their privileges to super-admin. This grants unauthorized access to the admin panel, enabling administrative control over the Grav installation. Attackers can abuse the scheduler to execute arbitrary code (remote code execution) and evaluate Twig templates, significantly compromising system integrity and confidentiality.

A fix is available in Grav Login plugin version 3.8.12. Users should upgrade to version 3.8.12 or later to remediate this vulnerability. No vendor advisory content is provided to indicate alternative mitigations or temporary fixes. Until patched, restricting authenticated user access or disabling the vulnerable profile update functionality may reduce risk.