CVE-2026-100670 Details
Description
Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admin.super` guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as `access.admin.super` (instead of the nested `access[admin][super]`) matches no blueprint rule, survives BlueprintSchema::filterArray() and flattening, and is written by FlexObject::update() via setNestedProperty(), which splits on `.` and reconstructs the nested value. An authenticated backend operator using the flex accounts backend who holds admin.users but not admin.super can therefore grant admin.super to their own account or to a group they belong to and escalate to full super-admin, gaining control over configuration, plugin and theme installation, the file manager, and all accounts. Fixed in 2.0.25, which drops any dotted key whose ancestor path is disabled or marked validate.ignore.
A privilege escalation vulnerability has been identified in Grav CMS versions 2.0.14 through 2.0.24. This vulnerability exists within the group and account blueprints, where the access map is protected by a 'security@: admin.super' guard. The vulnerability arises because a submitted flat dot-notation key, such as 'access.admin.super', bypasses the blueprint's security checks and is incorrectly processed, allowing an authenticated backend operator with limited permissions to grant themselves or others elevated rights. This exploitation can lead to unauthorized super-admin access, enabling control over critical administrative functions and all user accounts.
Users are advised to upgrade to Grav CMS version 2.0.25 or later, where this vulnerability has been fixed by properly validating and filtering flat dot-notation keys before they can bypass security guards.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-mwjj-r7vm-pgqm | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/grav-cms-2.0.14-through-2.0.24-privilege-escalation-via-blueprint-guard-bypass | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav CMS | >= 2.0.14, <= 2.0.24 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | New CVE Received | [email protected] |