CVE-2026-75837
CriticalCVSS 9.1Summary
Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.
Risk Assessment
A user with limited administrative privileges can gain full super-admin rights, potentially leading to unauthorized system changes and code execution.
Recommendation
Upgrade Grav to version 2.0.14 or later, which fixes this vulnerability.
Original NVD description (English source)
Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.