Executive brief
Grav CMS is a flat-file content management system used to build websites and applications. A security flaw in versions 2.0.14 through 2.0.24 allows an authenticated administrator with limited user management permissions to escalate to full super-admin access by bypassing access controls. An attacker could then install malicious plugins, modify configuration, access all user accounts, and take complete control of the CMS.
Technical details
The vulnerability exploits a path-based authorization bypass in blueprint field guards. The `security@: admin.super` guard validates nested array keys like `access[admin][super]` but fails to recognize flat dot-notation keys like `access.admin.super`. An authenticated operator with admin.users but not admin.super can submit the flat key, which bypasses BlueprintSchema::filterArray(), survives flattening, and is reconstructed by FlexObject::update() via setNestedProperty(), effectively granting super-admin privileges to their account or affiliated group.
Affected products
- Grav CMS 2.0.14 through 2.0.24
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in version 2.0.25