CVE-2026-59190
2026-07-10
17h17 +00:00
17h17 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacker with admin.users permission can change the password of any user account, including the super administrator, by sending a direct POST request to /admin/user/{username}?task=save with data[password] because saveUser authorizes the caller's user-management permission but does not verify whether the caller may edit the target user. This issue is expected to be fixed in version 1.10.53.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Authorization Bypass Through User-Controlled Key The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
