Advisory · CVE-2026-100670
Grav blueprint guard bypass turns a user admin into super-admin
Grav CMS 2.0.14 through 2.0.24 has a privilege escalation in the group and account blueprints: the access map guard 'admin.super' is resolved by the field's exact path, so a submitted flat dot-notation key like 'access.admin.super' matches no blueprint rule, survives filtering, and is written by setNestedProperty, which splits on dots and rebuilds the nested value. An authenticated backend operator with admin.users but not admin.super can grant admin.super to their own account or group, escalating to full super-admin with control over configuration, plugins, themes, the file manager, and all accounts. Fixed in 2.0.25.
- Vendor
- Grav
- Product
- Grav
- Identifier / CWE
- CVE-2026-100670
CWE-639 - Action timing
- Immediate
Explain it like I’m five
The permission form guards a checkbox labeled 'super admin' by its exact position on the page. A clerk writes the same request on a sticky note with dots between the words, the guard does not recognize the format, and the system grants the power anyway.
- 01Flat key submitted
An authenticated operator with admin.users submits a flat dot-notation key such as 'access.admin.super'.
- 02Guard miss
The blueprint access-map guard resolves by the field's exact path, so the flat key matches no rule.
- 03Filter survives
The unrecognized key survives blueprint filtering.
- 04Nested write
setNestedProperty splits the key on dots and rebuilds the nested value, granting admin.super: full super-admin.
What happened
Grav CMS 2.0.14 through 2.0.24 has a privilege escalation in the group and account blueprints (CVE-2026-100670, CVSS 8.8). The access map guard for admin.super is resolved by the field’s exact path, so a submitted flat dot-notation key like “access.admin.super” matches no blueprint rule, survives filtering, and is then written by setNestedProperty, which splits on dots and rebuilds the nested value. An authenticated backend operator with admin.users but not admin.super can grant admin.super to their own account or group, escalating to full super-admin with control over configuration, plugins, themes, the file manager, and all accounts. Fixed in Grav 2.0.25.
What to do
- Upgrade Grav to 2.0.25 or later.
- Audit user and group records for admin.super grants that predate the upgrade, especially ones with recent modification dates.
- Review the list of super-admin accounts and confirm each one is legitimate.
- Rotate credentials if an unauthorized super-admin cannot be ruled out.
Management note
Any operator who could manage users could become super-admin with a one-field trick. The upgrade closes the trick, but only an account audit tells you whether someone already used it.