Is CVE-2026-100670 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100670 being exploited in the wild.

How severe is CVE-2026-100670?

High severity, with a CVSS score of 8.8, published 26 September 2026.

Which products and versions are affected?

Grav CMS 2.0.14 through 2.0.24.

Is there a fix for CVE-2026-100670?

A patch was published on 2026-09-26: Fixed in version 2.0.25 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100670 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100670?

Check whether you run Grav CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100670: Grav CMS blueprint guard bypass privilege escalation

CVE-2026-100670 · Severity: high · CVSS 8.8 · Published 2026-09-26

Grav CMS is a flat-file content management system used to build websites and applications. A security flaw in versions 2.0.14 through 2.0.24 allows an authenticated administrator with limited user management permissions to escalate to full super-admin access by bypassing access controls. An attacker could then install malicious plugins, modify configuration, access all user accounts, and take complete control of the CMS.

Technologies: Grav CMS. Vendors: Grav.

Quick answers

Is CVE-2026-100670 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100670 being exploited in the wild.
How severe is CVE-2026-100670?: High severity, with a CVSS score of 8.8, published 26 September 2026.
Which products and versions are affected?: Grav CMS 2.0.14 through 2.0.24.
Is there a fix for CVE-2026-100670?: A patch was published on 2026-09-26: Fixed in version 2.0.25 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100670 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100670?: Check whether you run Grav CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exploits a path-based authorization bypass in blueprint field guards. The `security@: admin.super` guard validates nested array keys like `access[admin][super]` but fails to recognize flat dot-notation keys like `access.admin.super`. An authenticated operator with admin.users but not admin.super can submit the flat key, which bypasses BlueprintSchema::filterArray(), survives flattening, and is reconstructed by FlexObject::update() via setNestedProperty(), effectively granting super-admin privileges to their account or affiliated group.

Affected products

Grav CMS 2.0.14 through 2.0.24

Timeline

2026-09-26: disclosed
2026-09-26: patched: Fixed in version 2.0.25

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.