Is CVE-2026-75837 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75837 being exploited in the wild.

How severe is CVE-2026-75837?

Critical severity, with a CVSS score of 9.1, published 18 August 2026.

Which products and versions are affected?

Grav <= 2.0.12; getgrav/grav (Packagist) < 2.0.14, ECOSYSTEM:introduced=0,fixed=2.0.14.

Is there a fix for CVE-2026-75837?

Yes. getgrav/grav (Packagist): upgrade to 2.0.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75837 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-75837?

Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75837: Grav missing admin.super guard in group blueprint access field

Q: Which products and versions are affected?

Grav <= 2.0.12; getgrav/grav (Packagist) < 2.0.14, ECOSYSTEM:introduced=0,fixed=2.0.14.

Q: Is there a fix for CVE-2026-75837?

Yes. getgrav/grav (Packagist): upgrade to 2.0.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-75837 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-75837?

Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75837 · Severity: critical · CVSS 9.1 · Published 2026-08-18

Grav is a flat-file CMS used to manage websites without a database. An authenticated admin operator without super-admin privileges can escalate their account to full super-admin access by modifying a group's access permissions. This grants them unrestricted control of the admin panel, ability to execute code via the scheduler, and access to sensitive site configuration—equivalent to a complete account takeover.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-75837 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75837 being exploited in the wild.
How severe is CVE-2026-75837?: Critical severity, with a CVSS score of 9.1, published 18 August 2026.
Which products and versions are affected?: Grav <= 2.0.12; getgrav/grav (Packagist) < 2.0.14, ECOSYSTEM:introduced=0,fixed=2.0.14.
Is there a fix for CVE-2026-75837?: Yes. getgrav/grav (Packagist): upgrade to 2.0.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75837 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-75837?: Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

getgrav/grav (Packagist): upgrade to 2.0.14 or later
```
composer require getgrav/grav:^2.0.14
```

Technical details

A privilege escalation flaw exists in Grav's core group blueprint (`system/blueprints/user/group.yaml`). The `access` field, which defines permissions granted to all group members, lacks the `security@: admin.super` guard present in the functionally-identical account blueprint. This allows an authenticated operator holding only `admin.users.update` permission to POST a group-edit form with `access[admin][super]=1`. The Grav framework's `Blueprint::dynamicSecurity()` only applies field-level filtering for fields bearing the `security@` guard; since the group access field lacks this guard, it bypasses validation. The malicious value persists to `user://config/groups.yaml`, and on subsequent requests, `UserGroupObject::authorize()` grants super-admin privileges to all members of the group, including the attacker. The `check_authorize` field flag in the blueprint has zero PHP enforcement and provides no real protection. Patches should add the missing `security@: admin.super` guard or enforce a super-only strip on group ACL saves at the persistence layer.

Affected products

Grav Grav <= 2.0.12

Identifiers

CVE-2026-75837
GHSA-xhfv-7758-r9hx

Timeline

2026-09-17: disclosed
2026-09-17: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.