Privilege Escalation Vulnerability in Grav by GetGrav

CVE-2026-75837

What is CVE-2026-75837?

Grav versions prior to 2.0.14 exhibit a vulnerability that allows a delegated admin with 'admin.users' operator permissions to bypass security restrictions. Specifically, the access field in the core group blueprint is not adequately protected, allowing unauthorized elevation to super-admin privileges. This escalated access grants the ability to manage scheduler functionalities and execute Twig evaluations, compromising the integrity of the Grav environment.

References