CVE-2026-100670 in Grav
Summary
by MITRE • 09/26/2026
Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admin.super` guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as `access.admin.super` (instead of the nested `access[admin][super]`) matches no blueprint rule, survives BlueprintSchema::filterArray() and flattening, and is written by FlexObject::update() via setNestedProperty(), which splits on `.` and reconstructs the nested value. An authenticated backend operator using the flex accounts backend who holds admin.users but not admin.super can therefore grant admin.super to their own account or to a group they belong to and escalate to full super-admin, gaining control over configuration, plugin and theme installation, the file manager, and all accounts. Fixed in 2.0.25, which drops any dotted key whose ancestor path is disabled or marked validate.ignore.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/26/2026
Grav CMS versions 2.0.14 through 2.0.24 are affected by a critical privilege escalation vulnerability within the group and account blueprint configuration system. This flaw stems from an inconsistency in how access control rules are validated against submitted data structures, specifically involving the handling of nested security properties versus flat dot-notation keys. The core issue lies in the mismatch between the strict path matching required for blueprints to enforce restrictions and the flexible parsing logic used when saving user or group configurations via the Flex Object system.
The vulnerability is rooted in the interaction between BlueprintSchema::filterArray() and FlexObject::update(). In a properly secured configuration, access permissions such as admin.super are defined within nested structures like access[admin][super]. The blueprint validation mechanism relies on exact path matching to determine if a specific field should be filtered or allowed based on security guards. However, when an authenticated user submits data using flat dot-notation syntax, specifically the key access.admin.super, this format does not match the expected nested structure required by the blueprint rules. Consequently, the filterArray() method fails to recognize this input as violating the admin.super restriction because it is looking for a different structural representation of the same logical property.
Following the failed validation check, the data proceeds through a flattening process and is subsequently written using FlexObject::update(). This function utilizes setNestedProperty(), which intelligently parses dot-separated keys by splitting them on periods and reconstructing the corresponding nested array structure in memory. Because the initial security guard was bypassed due to the format mismatch, this reconstructed nested value containing admin.super privileges is accepted without triggering the intended access control checks. As a result, an authenticated backend operator who possesses administrative user management capabilities but lacks super-admin rights can exploit this logic flaw to grant themselves or their associated groups the highest level of privilege within the system.
The operational impact of this vulnerability is severe, as it allows for complete compromise of the Grav CMS installation environment. By escalating privileges to admin.super, an attacker gains unrestricted control over critical administrative functions including configuration management, plugin and theme installation, file system access through the integrated manager, and full oversight of all user accounts. This effectively neutralizes any role-based access controls implemented by administrators, allowing a low-privileged account holder to assume total authority over the platform. The flaw represents a classic case where input format normalization bypasses security validation logic, leading to unauthorized privilege elevation.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically regarding the failure to enforce proper access control checks during state changes or configuration updates. From an offensive perspective, it maps to MITRE ATT&CK technique T1078, Valid Accounts, as exploitation requires initial authentication but leverages a flaw in how those accounts' permissions are processed and updated within the application logic. The attack vector is primarily local to the backend interface, requiring only valid credentials with basic user management rights rather than network-level access or remote code execution capabilities.
The issue was resolved in Grav CMS version 2.0.25 through a defensive coding approach that enhances input sanitization during the update process. The fix implements logic to drop any dotted key if its ancestor path is either disabled or explicitly marked with validate.ignore attributes within the blueprint definitions. This ensures that even if an attacker attempts to use flat dot-notation to bypass nested structure validation, the system will reject such inputs based on their hierarchical context rather than just their literal string representation. Administrators running affected versions must upgrade immediately to mitigate this risk and restore the integrity of role-based access controls within the CMS environment.