CVE Intelligence
Analysis AI-assisted

CVE-2026-75837: Grav Privilege Escalation to Super-Admin via Group Access Field

Grav versions before 2.0.14 fail to protect the access field of the core group blueprint with the required super-admin restriction. According to the record, a delegated user with admin.users rights can save a group with elevated access and become super-admin, which also grants scheduler and Twig evaluation capabilities. No confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Grav versions before 2.0.14 contain a privilege escalation weakness in the core group blueprint. The access field is not guarded by the super-admin restriction the project requires, so a delegated user-management operator can raise their own privileges. The GitHub security advisory and the VulnCheck advisory are the references consulted.

Impact

  • A delegated admin.users operator can escalate to super-admin.
  • Per the record, super-admin status grants scheduler and Twig evaluation capabilities.
  • VulnCheck reports a CVSS 3.1 base score of 9.1 (Critical) and a CVSS 4.0 score of 9.3 in the record.

Affected products and versions

  • Getgrav Grav versions before 2.0.14.
  • The record's structured fixes list is empty. The stated affected range ends before 2.0.14, so upgrading to 2.0.14 or later appears to be the remediation (inference).

Exploitation status

  • The record lists this CVE as not present in the CISA KEV catalog.
  • No confirmed active exploitation appears in the sources consulted.
  • The record's SSVC exploitation value is 'poc' and automatable is 'no'.
  • The EPSS probability is 0.00494 with a percentile of 0.40749, dated 2026-10-13.

Remediation and mitigation

  • Upgrade Grav to version 2.0.14 or later.
  • Until the upgrade is applied, review which accounts hold admin.users delegation and limit that permission to trusted operators.
  • Audit existing group definitions for unexpected super-admin or elevated access grants.

Detection guidance

  • Review user and group configuration data for groups with unexpected administrative access settings.
  • Audit recent changes to group records made by delegated administrators.
  • Correlate administrative panel activity with changes to scheduler or template configuration.

Limitations of the available information

  • The record's source status is Deferred, and the structured data contains no fixed version.
  • The record does not provide proof-of-concept details or a full list of affected release branches beyond the stated range.
  • The record does not state whether the issue has been observed in production environments.

Frequently asked questions

What is the core issue in this Grav vulnerability?

The access field of the core group blueprint is not protected by the required super-admin restriction in versions before 2.0.14, allowing a delegated admin.users operator to escalate privileges.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.