# CVE-2026-42609: Grav Admin Panel account overwrite via business logic flaw

Source: https://junglewise.ai/threats/cve-2026-42609-grav-admin-panel-account-overwrite-via-business-logic-flaw  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2026-42609 · Severity: high · CVSS 8.1 · Published 2026-05-11

A security flaw in the Grav Admin Panel allows users with limited account-creation permissions to overwrite existing accounts, including those of high-level administrators. By creating a new user with an existing administrator's username, an attacker can effectively strip that administrator of their access rights. This results in a lockout of legitimate administrators and a complete loss of management control over the website.

Technologies: [Grav](https://junglewise.ai/threats/technologies/grav), [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-42609 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42609 being exploited in the wild.

**How severe is CVE-2026-42609?** High severity, with a CVSS score of 8.1, published 11 May 2026.

**Which products and versions are affected?** Grav < 2.0.0-beta.2, Prior to 2.0.0-beta.2; getgrav/grav (Packagist) < 2.0.0-beta.2, ECOSYSTEM:introduced=0,fixed=2.0.0-beta.2.

**Is there a fix for CVE-2026-42609?** Yes. getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42609 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42609?** Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later

  ```sh
  composer require getgrav/grav:^2.0.0-beta.2
  ```


## Technical details

A business logic vulnerability exists in Grav's user management module due to insecure 'Create or Update' logic. When a user with 'admin.users.create' permissions attempts to create a new user with a username that already exists, the system fails to validate the conflict and instead overwrites the existing user's configuration file (e.g., YAML metadata). While the attacker cannot grant themselves higher privileges, they can effectively wipe the permissions of a target Super User, leading to a Denial of Service (DoS) on administrative functions. The fix involves tightening the uniqueness guard in 'UserObject::save' and ensuring the check applies across all storage backends.

## Affected products

- getgrav Grav < 2.0.0-beta.2

## Identifiers

- CVE-2026-42609
- GHSA-rr73-568v-28f8

## Timeline

- 2026-04-24: patched: Fix applied to Grav core 2.0 branch.
- 2026-05-05: disclosed: GitHub Advisory published.
- 2026-05-11: advisory: NVD published CVE-2026-42609.

## References

- [https://api.github.com/users/AnhNg1410](https://api.github.com/users/AnhNg1410)
- [https://github.com/AnhNg1410](https://github.com/AnhNg1410)
- [https://api.github.com/users/AnhNg1410/gists%7B/gist_id%7D](https://api.github.com/users/AnhNg1410/gists%7B/gist_id%7D)
- [https://api.github.com/users/AnhNg1410/repos](https://api.github.com/users/AnhNg1410/repos)
- [https://avatars.githubusercontent.com/u/125843334?v=4](https://avatars.githubusercontent.com/u/125843334?v=4)
- [https://api.github.com/users/AnhNg1410/events%7B/privacy%7D](https://api.github.com/users/AnhNg1410/events%7B/privacy%7D)

## Related threats

- [Grav allowlist bypass in Flex form processing](https://junglewise.ai/threats/cve-2026-116019-grav-2-0-15-before-2-2-13-contains-an-allowlist-bypass)
- [Grav improper access control in FlexDirectory::dynamicFlexField()](https://junglewise.ai/threats/cve-2026-114660-grav-from-2-0-0-before-2-2-5-contains-an-improper-access-control)
- [Grav information disclosure via Twig HTTP Basic credentials](https://junglewise.ai/threats/cve-2026-114657-grav-from-2-0-0-before-2-2-5-contains-an-information-disclosure)
- [Grav image pixel limit bypass allows resource exhaustion](https://junglewise.ai/threats/cve-2026-112782-grav-1-7-53-before-1-7-53-5-and-2-0-0-rc-8-before-2-2-2-contains)
- [Grav information disclosure via nested Git repositories](https://junglewise.ai/threats/cve-2026-109326-grav-before-2-1-7-contains-an-information-disclosure)