CVE-2026-75837 in Grav
Summary
by MITRE • 08/18/2026
Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in Grav versions prior to 2.0.14 represents a critical authorization bypass within the core administrative interface, specifically targeting the user group management functionality. The flaw stems from an insufficient access control mechanism on the security field of the admin.users blueprint. In a properly secured system, operations that modify high-privilege attributes such as super-admin status should be restricted to users with explicit and elevated permissions, typically denoted by the admin.super capability. However, due to this oversight, the validation logic fails to enforce these restrictions when saving group configurations through the delegated administration interface.
This technical flaw allows a user who has been granted the authority to manage other users via the admin.users operator role to manipulate their own or others' group assignments in ways that were not intended by the system administrators. Specifically, an attacker with this limited privilege level can edit a group configuration and set the access[admin][super] field to true. Because the backend does not verify whether the requesting user possesses the necessary super-admin privileges before accepting this change, the operation is processed successfully. This constitutes a classic case of broken access control where lower-privileged actors are able to elevate their own permissions beyond what was originally granted by the system administrator.
The operational impact of this vulnerability is severe, as it results in complete privilege escalation from a delegated user operator to a super-administrator. Once an attacker achieves super-admin status, they gain unrestricted access to all administrative features within Grav. This includes the ability to manage plugins and themes without restriction, modify core configuration files, and execute arbitrary code through built-in tools such as the scheduler module or Twig template engine evaluation capabilities. The acquisition of these advanced privileges effectively compromises the entire web application environment, allowing for full system takeover depending on how Grav is deployed and what other services are accessible from that context.
From a classification perspective, this vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves an actor obtaining elevated access levels without proper authorization. It also maps to MITRE ATT&CK technique T1078, specifically Valid Accounts and potentially T1068 Exploitation for Privilege Escalation, since the attacker leverages legitimate but misconfigured credentials to gain higher-level system control. The scenario highlights the risks associated with delegated administration models where fine-grained permissions are not rigorously validated against high-risk actions during state changes in user management interfaces.
To mitigate this vulnerability, organizations running Grav versions earlier than 2.0.14 must upgrade immediately to version 2.0.14 or later, which includes the necessary patches to enforce strict access controls on group blueprint modifications. Until an upgrade is feasible, administrators should review their delegated permission structures and ensure that no users are assigned the admin.users operator role unless absolutely necessary, as this role currently serves as a vector for privilege escalation. Additionally, implementing robust monitoring of administrative actions can help detect unauthorized attempts to modify super-admin privileges, although upgrading remains the only definitive remediation strategy given the fundamental nature of the access control flaw in the application logic.