CVE-2026-75837
published 2026-08-18CVE-2026-75837: Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users…
PriorityP351critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EPSS
0.49%
41.6th percentile
Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | < 2.0.14 | 2.0.14 |
| getgrav | grav | >= 0 < 2.0.14 | 2.0.14 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa9.4CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
ghsa·2026-09-17·CVSS 9.4
CVE-2026-75837 [CRITICAL] CWE-269 Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
## Summary
The core Flex group blueprint `system/blueprints/user/group.yaml` (access field, lines 48-55) omits the `security@: admin.super` field guard that its sibling account blueprint carries (`account.yaml:131/138/150`, added by the CVE-2026-42613 fix). A delegated non-super operator holding `admin.users.update` can therefore save a group whose `access` map contains `admin.super: true`, which `UserGroupObject::authorize` then grants to every member of that group, a full privilege escalation to super-admin (scheduler/cron RCE, Twig eval). This is a distinct file, sink, and fix from all four related advisories.
## Root Cause
The CVE-2026-42613 fix protected the ac
GHSA
Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction.
ghsa_unreviewed·2026-08-18
CVE-2026-75837 [CRITICAL] CWE-269 Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction.
Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-18
Published