CVE-2026-75837

Grav CMS before 2.0.14 lacks a security@: admin.super guard on the group blueprint access field. A delegated admin.users operator can save access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities. CISA classifies it as total impact; no public exploi...