CVE-2026-75837: Grav Package Vulnerability Allows Privilege Escalation to Super-Admin
Summary
CVE-2026-75837: The core Flex group blueprint system/blueprints/user/group.yaml (access field, lines 48-55) omits the security@: admin.super field guard that its sibling account blueprint carries (account.yaml:131/138/150, added by the... Affects getgrav/grav versions < 2.0.14. Fixed in 2.0.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grav is a modern open-source flat-file content management system (CMS) that allows users to create and manage websites without the need for a traditional database. It is designed for speed and simplicity, utilizing a flexible architecture that supports various plugins and themes. However, a vulnerability has been identified in the Grav package that allows unauthorized users to escalate their privileges to super-admin status, compromising the security of the system.
Vulnerability Detail
The vulnerability arises from a missing security guard in the core Flex group blueprint of Grav. Specifically, the access field in the user group blueprint does not enforce the necessary security checks, allowing a delegated non-super operator with 'admin.users.update' permissions to save a group configuration that grants super-admin privileges. This oversight can lead to full privilege escalation, enabling unauthorized access to sensitive functionalities such as the admin panel and scheduler, which could be exploited for remote code execution (RCE). The root cause is the absence of the 'security@: admin.super' field guard, which is present in the account blueprint but missing in the group blueprint, leading to a significant security gap.
How To Fix
Minimum fixed version
2.0.14
This is the first release that contains the fix.
composer require getgrav/grav:2.0.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually edit the group blueprint file located at 'system/blueprints/user/group.yaml' to include the missing security guard. Add the following line to the access field: 'security@: admin.super'. This will enforce the necessary security checks until an official patch is applied.
Conclusion
The CVE-2026-75837 vulnerability in the Grav package poses a significant risk by allowing unauthorized privilege escalation to super-admin status. It is crucial for users to update to version 2.0.14 or later to mitigate this risk. Additionally, applying the provided workaround can help secure your installation until an update can be performed.
See every vulnerability recorded for getgrav/grav →
FAQ
CVE-2026-75837 is a vulnerability in the Grav package that allows unauthorized users to escalate their privileges to super-admin status due to a missing security guard in the group blueprint.
If your Grav installation is affected, unauthorized users with limited permissions could gain full access to the admin panel and execute arbitrary code, compromising the security of your site.
All versions of Grav up to and including 2.0.12 are affected by this vulnerability. The issue has been fixed in version 2.0.14.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot update immediately, consider applying the manual workaround by adding the security guard to the group blueprint file as described in the workaround section.
Related vulnerabilities
Recent vulnerabilities recorded for getgrav/grav.
