An authenticated backend operator, possessing at least 'admin.users' permissions, can submit an account update request using a flat dot-notation key (e.g., access.admin.super) instead of the expected nested array structure (access[admin][super]). This malformed key bypasses the blueprint validation rules, enabling the FlexObject::update() method to invoke setNestedProperty() with the unauthorized value. By exploiting this, an attacker can modify their own account's access level to include admin.super, effectively escalating to full administrative control over the CMS, including plugin/theme installation and file system management. This was remediated in version 2.0.25 by enforcing strict validation on dotted keys.

Impact

Successful exploitation results in full super-admin account compromise for an authenticated user with limited backend access. Attackers can gain complete control over the CMS configuration, perform unauthorized plugin and theme installations, access the file manager, and manipulate all other user accounts. This represents a significant risk to the integrity and confidentiality of the entire Grav CMS environment.

Recommendation

• Upgrade Grav CMS to version 2.0.25 or later immediately to apply the patch for CVE-2026-100670.
• Audit administrative account activity logs to identify suspicious modifications to user access levels or unauthorized escalation attempts occurring between September 2026 and the time of patching.
• Restrict access to the backend Flex accounts interface to a strictly controlled set of trusted administrators until the software is updated.