Privilege Escalation in Grav CMS by GetGrav

CVE-2026-100670

What is CVE-2026-100670?

Grav CMS versions 2.0.14 through 2.0.24 contain a security issue allowing authenticated users with specific backend access to escalate their privileges. This vulnerability exploits the incorrect handling of access map validations where submitted flat dot-notation keys can bypass intended security rules. An attacker with admin.users permissions can manipulate their account or associated groups to gain full super-admin rights, adversely impacting control over site configuration and user management. The issue has been addressed in version 2.0.25, which prevents the use of such dotted keys if the parent path is inactive or set to ignore.

References