Executive brief
Grav is a flat-file CMS used to manage websites without a database. An authenticated admin operator without super-admin privileges can escalate their account to full super-admin access by modifying a group's access permissions. This grants them unrestricted control of the admin panel, ability to execute code via the scheduler, and access to sensitive site configuration—equivalent to a complete account takeover.
Technical details
A privilege escalation flaw exists in Grav's core group blueprint (`system/blueprints/user/group.yaml`). The `access` field, which defines permissions granted to all group members, lacks the `security@: admin.super` guard present in the functionally-identical account blueprint. This allows an authenticated operator holding only `admin.users.update` permission to POST a group-edit form with `access[admin][super]=1`. The Grav framework's `Blueprint::dynamicSecurity()` only applies field-level filtering for fields bearing the `security@` guard; since the group access field lacks this guard, it bypasses validation. The malicious value persists to `user://config/groups.yaml`, and on subsequent requests, `UserGroupObject::authorize()` grants super-admin privileges to all members of the group, including the attacker. The `check_authorize` field flag in the blueprint has zero PHP enforcement and provides no real protection. Patches should add the missing `security@: admin.super` guard or enforce a super-only strip on group ACL saves at the persistence layer.
Affected products
- Grav Grav <= 2.0.12
Timeline
- 2026-09-17: disclosed
- 2026-09-17: advisory