CVE-2026-42609: Grav Admin Panel account overwrite via business logic flaw

CVE-2026-42609 · Severity: high · CVSS 8.1 · Published 2026-05-11

A security flaw in the Grav Admin Panel allows users with limited account-creation permissions to overwrite existing accounts, including those of high-level administrators. By creating a new user with an existing administrator's username, an attacker can effectively strip that administrator of their access rights. This results in a lockout of legitimate administrators and a complete loss of management control over the website.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-42609 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42609 being exploited in the wild.
How severe is CVE-2026-42609?
High severity, with a CVSS score of 8.1, published 11 May 2026.
Which products and versions are affected?
Grav < 2.0.0-beta.2, Prior to 2.0.0-beta.2; getgrav/grav (Packagist) < 2.0.0-beta.2, ECOSYSTEM:introduced=0,fixed=2.0.0-beta.2.
Is there a fix for CVE-2026-42609?
Yes. getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42609 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42609?
Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later
    composer require getgrav/grav:^2.0.0-beta.2

Technical details

A business logic vulnerability exists in Grav's user management module due to insecure 'Create or Update' logic. When a user with 'admin.users.create' permissions attempts to create a new user with a username that already exists, the system fails to validate the conflict and instead overwrites the existing user's configuration file (e.g., YAML metadata). While the attacker cannot grant themselves higher privileges, they can effectively wipe the permissions of a target Super User, leading to a Denial of Service (DoS) on administrative functions. The fix involves tightening the uniqueness guard in 'UserObject::save' and ensuring the check applies across all storage backends.

Affected products

  • getgrav Grav < 2.0.0-beta.2

Identifiers

  • CVE-2026-42609
  • GHSA-rr73-568v-28f8

Timeline

  • 2026-04-24: patched: Fix applied to Grav core 2.0 branch.
  • 2026-05-05: disclosed: GitHub Advisory published.
  • 2026-05-11: advisory: NVD published CVE-2026-42609.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.