CVE-2026-42613
published 2026-05-11CVE-2026-42613: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields…
PriorityP265critical9.4CVSS 3.1
AVNACLPRNUINSUCHIHAL
EPSS
0.56%
45.8th percentile
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are included in the configured allowed fields list, an unauthenticated user can self-register with admin.super privileges by injecting these fields into the registration request. This vulnerability is fixed in 2.0.0-beta.2.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | < 2.0.0-beta.2 | 2.0.0-beta.2 |
| getgrav | grav | >= 0 < 2.0.14 | 2.0.14 |
| getgrav | grav | >= 0 < 2.0.0-beta.2 | 2.0.0-beta.2 |
CVSS provenance
nvdv3.19.4CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
ghsa9.4CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
ghsa·2026-09-17·CVSS 9.4
CVE-2026-75837 [CRITICAL] CWE-269 Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
## Summary
The core Flex group blueprint `system/blueprints/user/group.yaml` (access field, lines 48-55) omits the `security@: admin.super` field guard that its sibling account blueprint carries (`account.yaml:131/138/150`, added by the CVE-2026-42613 fix). A delegated non-super operator holding `admin.users.update` can therefore save a group whose `access` map contains `admin.super: true`, which `UserGroupObject::authorize` then grants to every member of that group, a full privilege escalation to super-admin (scheduler/cron RCE, Twig eval). This is a distinct file, sink, and fix from all four related advisories.
## Root Cause
The CVE-2026-42613 fix protected the ac
GHSA
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
ghsa·2026-05-05
CVE-2026-42613 [CRITICAL] CWE-20 Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
# Bug Report: Registration Privilege Escalation via Missing Server-Side Validation of groups/access
## Summary
The `Login::register()` method in the Login plugin accepts attacker-controlled `groups` and `access` fields from the registration POST data without server-side validation. When registration is enabled and `groups` or `access` are included in the configured allowed fields list, an unauthenticated user can self-register with `admin.super` privileges by injecting these fields into the registration request.
This is a missing server-side validation issue — the only defense is a config-level `fields` allowlist, which is an admin-facing setting, not a hardcoded security boundary.
## Affected
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-11
Published