Grav Group Access Privilege Escalation

Executive Summary

CVE-2026-75837 is a critical privilege escalation flaw in Grav CMS versions before 2.0.14. It allows a delegated admin.users operator to escalate privileges to super-admin by exploiting a missing security guard in the group blueprint system. The attacker sets access[admin][super]=true in a group's access configuration, granting them scheduler and Twig evaluation capabilities.

Useful 0 Not Useful 0

Detection Guidance

Check Grav version with: grep -r "version:" /path/to/grav/user/config/system.yaml. If version is below 2.0.14, the system is vulnerable. Inspect group.yaml for missing security@: admin.super guard in access field.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with limited admin privileges to gain full super-admin access. This could lead to complete control over the Grav CMS installation, enabling execution of arbitrary code via scheduler RCE, manipulation of Twig templates, and rewriting group access control lists. The impact includes potential data breaches, system compromise, and unauthorized administrative actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. Super-admin privileges allow attackers to exfiltrate, modify, or delete protected health information or personal data, violating confidentiality requirements. Organizations using vulnerable Grav versions may face regulatory penalties, loss of certification, and reputational damage due to inadequate access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav to version 2.0.14 or later immediately. Verify the group.yaml file includes security@: admin.super guard for the access field. Remove any unauthorized super-admin privileges from groups.

Useful 0 Not Useful 0