CVE-2026-75837: Privilege Escalation in Grav CMS via Missing Blueprint Validation
Vulnerability ID: CVE-2026-75837
CVSS Score: 9.1
Published: 2026-09-17
CVE-2026-75837 is a critical privilege escalation vulnerability affecting the Grav Flat-File Content Management System (CMS) in versions prior to 2.0.14. Due to a missing security guard on the access field within the core Flex group blueprint configuration file (system/blueprints/user/group.yaml), a delegated administrative operator can submit a crafted payload to elevate their permissions to super-administrator, which can then be leveraged to achieve remote code execution.
TL;DR
A missing security decorator in Grav's group blueprint allowed delegated admin users to assign themselves super-admin privileges, leading to potential remote code execution.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-269
- Attack Vector: Network
- CVSS v3.1: 9.1 (Critical)
- EPSS Score: 0.00339 (Percentile: 27.20%)
- Exploit Status: PoC
- KEV Status: Not Listed
Affected Systems
- Grav CMS
-
grav: < 2.0.14 (Fixed in:
2.0.14)
Code Analysis
Commit: 5192316
Fix group blueprint dynamic security bypass (GHSA-xhfv-7758-r9hx)
Exploit Details
- GitHub Security Advisory: Vulnerability mechanism and unit tests published alongside coordinator disclosures
Mitigation Strategies
- Upgrade Grav CMS to version 2.0.14 or above
- Apply manual hotfix to system/blueprints/user/group.yaml if immediate upgrade is not feasible
- Implement regular audits of user group configuration files for unauthorized permissions
Remediation Steps:
- Locate system/blueprints/user/group.yaml inside your Grav installation directory.
- Find the 'access:' field parameter.
- Add 'security@: admin.super' under the access configuration parameters.
- Save the file and clear the Grav cache by executing 'bin/grav clear-cache'.
References
- GitHub Security Advisory
- National Vulnerability Database (NVD)
- Vulnerability & Exploit Research Release
- Git Commit Patch Diff
Read the full report for CVE-2026-75837 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)