CVE-2025-66301

Grav CMS contains a broken access control vulnerability (CVE-2025-66301) where an editor with only basic content permissions can modify the YAML frontmatter data[_json][header][form] in POST to /admin/pages/{page_name}, altering the form processing logic. Root cause: improper authorization checks...