Threat Intelligence Database

CVE-2026-72700 is a timing discrepancy vulnerability in the getgrav/grav-plugin-login Composer plugin before version 3.9.1. The plugin compares password reset and account activation tokens using a non-constant-time string comparison instead of a timing-safe function, which could allow an attacker to infer valid tokens by measuring response times. The token submission endpoint also lacks rate limiting, increasing the theoretical risk. However, the vendor rates the practical exploitability as low, and no confirmed network exploit has been demonstrated.

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.