Improper Privilege Management

Grav is vulnerable to Improper Privilege Management. The vulnerability is due to insufficient access restrictions on the access field in the core group blueprint, which allows a delegated admin.users operator to grant themselves super-admin privileges and gain access to scheduler and Twig...

GHSA-M97H-2QJ3-5773 Duplicate Advisory: Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xhfv-7758-r9hx. This link is maintained to preserve external references. Original Description Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.sup...

CVE-2026-75837: Improper Privilege Management

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with accessadminsuper=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities...