Because this guard is missing from the group blueprint, a delegated administrator holding only admin.users.update permissions can successfully submit a request to update a group's access map. By injecting admin.super: true into the group's access configuration, the attacker effectively grants the 'super-admin' role to all members of that group. This escalation provides full administrative control over the application, including access to the scheduler, which can be leveraged for Remote Code Execution (RCE) via cron jobs, and potential Twig template evaluation.

Attack Chain

1. Initial Access: The attacker authenticates as a user with admin.users.update permissions, which is typically granted to delegated administrators responsible for user management.
2. Discovery: The attacker identifies that they can modify group access configurations, as the application exposes groups at the admin.users:crudl path, which the attacker has permission to update.
3. Form Submission: The attacker sends a POST request to the /admin/accounts/groups/ endpoint, embedding the malicious payload access[admin][super]=true within the group update data.
4. Blueprint Bypass: The system's Blueprint::dynamicSecurity check fails to flag the access field as restricted because the group.yaml blueprint lacks the required security@: admin.super declaration.
5. Validation Bypass: The BlueprintSchema::filterArray and Validation::filterArray logic processes the payload and retains the restricted admin.super key because the input is not marked for filtering.
6. Persistence: The application saves the unauthorized access configuration to user://config/groups.yaml via the FlexObject::update() path without further authorization checks.
7. Privilege Escalation: Upon the next request, the UserGroupObject::authorize('admin.super') method evaluates the modified group ACL and returns true, promoting the attacker to full super-admin status.
8. Impact: The attacker utilizes the escalated super-admin privileges to access the administrative dashboard, modify scheduler tasks, or execute malicious Twig templates to achieve RCE.

Impact

Successful exploitation results in full administrative control (C:H/I:H/A:H) over the Grav instance. The attacker gains the ability to manage all users, execute arbitrary code via the scheduler, and modify system files. This vulnerability affects all Grav versions up to and including 2.0.12.

Recommendation

Prioritized actions for security and IT operations teams:

• Update Grav to version 2.0.14 or later immediately to incorporate the required blueprint security guards.
• Audit existing user://config/groups.yaml files for any unauthorized admin.super: true entries in group access maps.
• Review all users currently holding the admin.users role to identify accounts that should not have the ability to modify group permissions.
• Use server-side web application logs to monitor for unauthorized POST requests to /admin/accounts/groups/ originating from non-super-admin accounts.

Impact

Successful exploitation allows an authenticated user to gain access to sensitive application configuration data. This includes administrative secrets required for third-party integrations and backend services. Exposure of these credentials can facilitate further compromise of internal infrastructure, external services, and data exfiltration, significantly increasing the attacker's footprint within the environment.

Recommendation

• Upgrade all instances of Grav CMS to version 2.0.22 or later immediately to patch CVE-2026-92917.
• Audit web application logs for administrative users accessing Twig-related rendering functions, specifically looking for attempts to use print_r, vardump, or json_encode filters within page content updates.
• Revoke and rotate all secrets (SMTP, API tokens, webhooks) found in the Grav configuration if a compromise is suspected to have occurred between version 2.0.0-rc.1 and 2.0.22.