Description

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T12:19:33.913Z",
  "pubdate": "2026-08-18T12:19:33.913Z",
  "executiveSummary": "Grav versions prior to 2.0.14 suffer from an insufficient access control vulnerability within the core group blueprint mechanism. This flaw allows a malicious user with delegated administrative operator privileges (admin.users) to manipulate the access control configuration during group creation or modification.\nSpecifically, the application fails to enforce the mandatory security@: admin.super restriction on the access field within the core group blueprint. By explicitly injecting parameters such as access[admin][super]=true when saving a group object, an attacker can successfully escalate their privileges to super-administrator status.\nThis elevation of privilege grants the threat actor access to highly sensitive administrative capabilities, including the integrated scheduler and arbitrary Twig template evaluation execution paths. Successful exploitation enables full system compromise by permitting remote code execution via server-side template injection vectors inherent to the administrative Twig evaluation feature.\nThe vulnerability represents a critical security risk to deployments utilizing delegated administrative roles, as it undermines the principle of least privilege by allowing lower-privileged administrators to bypass security boundaries and attain absolute administrative control over the underlying Grav CMS instance.",
  "technicalDetails": "The vulnerability resides in the authorization and input validation logic handling user group blueprints within Grav core prior to version 2.0.14. Group configuration blueprints define the schema and permission constraints applied when administrators create or edit user groups through the administrative interface.\nThe root cause of the vulnerability is the omission of the required security@: admin.super access restriction directive on the access field in the core group blueprint definition. Consequently, the input validation and persistence layers fail to sanitize or restrict input targeting super-user access parameters within group payload requests.\nAn attacker possessing low-level administrative operator privileges (specifically, the delegated admin.users capability) can leverage this flaw through the following attack flow. First, the attacker intercepts or crafts an HTTP request submitted during the group save operation. Within the POST parameters of the group modification request, the attacker injects the unauthorized privilege parameter access[admin][super]=true.\nBecause the backend validation lacks the necessary administrative security constraint, the application accepts the injected parameter and persists the elevated permissions within the group configuration. When the attacker's user account is associated with this modified group, the session inherits the super-administrator privileges associated with the access[admin][super] flag.\nPost-exploitation impact is severe. Attaining super-administrator privileges grants access to restricted administrative modules, most notably the scheduler component and features permitting the evaluation of Twig templates. Since Twig template evaluation in Grav executes arbitrary code within the context of the web server, the attacker can leverage this capability to achieve remote code execution (RCE), execute system commands, and completely compromise the host system."
}