CVE-2026-100670
Deferred Deferred - Pending Action

Privilege Escalation in Grav CMS via Dot-Notation Key Bypass

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admin.super` guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as `access.admin.super` (instead of the nested `access[admin][super]`) matches no blueprint rule, survives BlueprintSchema::filterArray() and flattening, and is written by FlexObject::update() via setNestedProperty(), which splits on `.` and reconstructs the nested value. An authenticated backend operator using the flex accounts backend who holds admin.users but not admin.super can therefore grant admin.super to their own account or to a group they belong to and escalate to full super-admin, gaining control over configuration, plugin and theme installation, the file manager, and all accounts. Fixed in 2.0.25, which drops any dotted key whose ancestor path is disabled or marked validate.ignore.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100670
EUVD
EUVD-2026-87764

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
grav cms From 2.0.14 (inc) to 2.0.24 (inc)
grav cms 2.0.25
getgrav grav From 2.0.14 (inc) to 2.0.24 (inc)
getgrav grav 2.0.25

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100670 is a privilege escalation flaw in Grav CMS versions 2.0.14 through 2.0.24. It allows authenticated users with admin.users but not admin.super permissions to grant themselves super-admin privileges by submitting a flat dot-notation key like access.admin.super instead of the proper nested structure. This bypasses security checks and grants full control over the CMS.

Detection Guidance

Check Grav CMS version with: composer show getgrav/grav. If version is between 2.0.14 and 2.0.24, the system is vulnerable. Inspect user accounts with admin.users but not admin.super permissions for unusual privilege changes.

Impact Analysis

An attacker could gain full administrative control over your Grav CMS instance. This includes modifying configurations, installing or removing plugins and themes, managing files, and controlling all user accounts. The attack requires only an authenticated account with limited admin privileges and access to the flex accounts backend.

Compliance Impact

This vulnerability could lead to unauthorized access and control of sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. Unauthorized privilege escalation may result in data breaches, unauthorized modifications, and loss of audit trails, all of which are critical compliance violations.

Mitigation Strategies

Upgrade Grav CMS to version 2.0.25 or later immediately. Review all accounts with admin.users permissions for unauthorized super-admin grants. Remove any flat dot-notation keys like access.admin.super from user or group configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100670. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart