CVE-2026-75837: Grav before 2.0.14 Privilege Escalation via Group Access Field
Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gravto a version that resolves this vulnerability.Fixed in 2.0.14
Event History
Frequently Asked Questions
Which users can exploit this issue?
Instances running Grav before 2.0.14 are affected when an account has delegated admin.users privileges. That role can modify a group and set access[admin][super]=true, elevating itself to super-admin.
What access does an attacker need to exploit it?
No user interaction is required, but the attacker must already be authenticated with delegated admin.users access. The vulnerable action is saving a modified group configuration through the group access field.
What is the recommended mitigation?
Upgrade Grav to version 2.0.14 or later. If upgrading cannot happen immediately, restrict or remove delegated admin.users permissions from untrusted accounts to prevent group modifications that grant super-admin access.
How can I check for possible exploitation?
Review group configurations for access[admin][super]=true and identify whether users with delegated admin.users access have created or modified groups. Any unexpected super-admin group assignment should be treated as evidence requiring investigation.