Grav Privilege Escalation via Group Blueprint ACL Bypass

Grav version 2.0.12 and earlier contains a privilege escalation vulnerability within its Flex group management functionality. The core group blueprint file located at system/blueprints/user/group.yaml omits a mandatory security@: admin.super guard on the group access field. In the Grav Flex architecture, the security@ guard is the primary mechanism that flags fields for exclusion during the data save path for non-super users.

Because this guard is missing from the group blueprint, a delegated administrator holding only admin.users.update permissions can successfully submit a request to update a group's access map. By injecting admin.super: true into the group's access configuration, the attacker effectively grants the 'super-admin' role to all members of that group. This escalation provides full administrative control over the application, including access to the scheduler, which can be leveraged for Remote Code Execution (RCE) via cron jobs, and potential Twig template evaluation.

Attack Chain

1. Initial Access: The attacker authenticates as a user with admin.users.update permissions, which is typically granted to delegated administrators responsible for user management.
2. Discovery: The attacker identifies that they can modify group access configurations, as the application exposes groups at the admin.users:crudl path, which the attacker has permission to update.
3. Form Submission: The attacker sends a POST request to the /admin/accounts/groups/ endpoint, embedding the malicious payload access[admin][super]=true within the group update data.
4. Blueprint Bypass: The system's Blueprint::dynamicSecurity check fails to flag the access field as restricted because the group.yaml blueprint lacks the required security@: admin.super declaration.
5. Validation Bypass: The BlueprintSchema::filterArray and Validation::filterArray logic processes the payload and retains the restricted admin.super key because the input is not marked for filtering.
6. Persistence: The application saves the unauthorized access configuration to user://config/groups.yaml via the FlexObject::update() path without further authorization checks.
7. Privilege Escalation: Upon the next request, the UserGroupObject::authorize('admin.super') method evaluates the modified group ACL and returns true, promoting the attacker to full super-admin status.
8. Impact: The attacker utilizes the escalated super-admin privileges to access the administrative dashboard, modify scheduler tasks, or execute malicious Twig templates to achieve RCE.

Impact

Successful exploitation results in full administrative control (C:H/I:H/A:H) over the Grav instance. The attacker gains the ability to manage all users, execute arbitrary code via the scheduler, and modify system files. This vulnerability affects all Grav versions up to and including 2.0.12.

Recommendation

Prioritized actions for security and IT operations teams:

• Update Grav to version 2.0.14 or later immediately to incorporate the required blueprint security guards.
• Audit existing user://config/groups.yaml files for any unauthorized admin.super: true entries in group access maps.
• Review all users currently holding the admin.users role to identify accounts that should not have the ability to modify group permissions.
• Use server-side web application logs to monitor for unauthorized POST requests to /admin/accounts/groups/ originating from non-super-admin accounts.