Grav - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/grav/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 06 May 2026 21:19:21 +0000Grav CMS API Blueprint Upload Privilege Escalationhttps://feed.craftedsignal.io/briefs/2024-01-grav-api-privesc/Wed, 06 May 2026 21:19:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-grav-api-privesc/A low-privileged authenticated API user with `api.media.write` can abuse `/api/v1/blueprint-upload` in Grav CMS to write an arbitrary YAML file into `user/accounts/`, enabling creation of a super-admin account and leading to full administrative compromise of the Grav API.A vulnerability in Grav CMS version 2.0.0-beta.2 allows a low-privileged, authenticated API user to escalate privileges to a super administrator. This flaw resides in the /api/v1/blueprint-upload endpoint. By manipulating the destination and scope parameters, an attacker can write an arbitrary YAML file into the user/accounts/ directory. This circumvents intended access controls, allowing the creation of a new administrator account with api.super privileges. Exploitation requires only api.media.write access. Successful exploitation leads to complete control over the CMS management API, potentially enabling further attacks such as code execution. This vulnerability was disclosed on May 6, 2026, and poses a significant threat to Grav CMS installations using the API plugin.

Attack Chain

  1. Attacker authenticates to the Grav CMS API using a low-privileged account with api.media.write permissions.
  2. The attacker crafts a malicious HTTP POST request to /api/v1/blueprint-upload.
  3. The request includes multipart form data with the destination parameter set to self@: and the scope parameter set to users/anything.
  4. The request includes a file parameter containing a YAML file crafted to create a new admin user, including setting a plaintext password and api.super access.
  5. The Grav CMS API resolves the file path based on the destination and scope parameters, writing the malicious YAML file to the user/accounts/ directory.
  6. The attacker authenticates to the Grav CMS API using the newly created admin user credentials defined in the YAML file.
  7. The attacker successfully logs in as a super administrator, gaining full access to the Grav CMS management API.
  8. The attacker leverages their elevated privileges to modify content, alter configurations, manage users, or install malicious plugins/themes, ultimately achieving complete CMS compromise.

Impact

Successful exploitation grants an attacker full control over the Grav CMS instance. An attacker can modify website content, alter configurations, manage users (including creating additional administrator accounts), install or update plugins/themes, and access system-level administration features. This can lead to complete CMS compromise, potentially resulting in data theft, defacement, or further exploitation, such as server-side code execution. The vulnerability allows any user with limited API access (api.media.write) to create a super administrator account, drastically increasing the attack surface and potential for widespread damage.

Recommendation

  • Upgrade Grav CMS to version 2.0.0-beta.4 or later to patch the vulnerability as per the advisory (https://github.com/advisories/GHSA-6xx2-m8wv-756h).
  • Deploy the Sigma rule Detect Grav CMS Malicious Blueprint Upload to detect attempts to exploit this vulnerability by monitoring for suspicious blueprint uploads to the user/accounts directory.
  • Implement the Sigma rule Detect Grav CMS New Admin User Creation via API to identify the creation of new admin users via the API endpoint.
  • Restrict api.media.write permissions to only trusted users, reducing the potential attack surface.
]]>criticaladvisorygravcmsprivilege-escalationyaml-injectionGrav CMS Privilege De-escalation via User Overwritehttps://feed.craftedsignal.io/briefs/2026-05-grav-privilege-deescalation/Wed, 06 May 2026 14:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-grav-privilege-deescalation/A low-privileged user with user creation permissions in Grav CMS can overwrite existing accounts, including the primary administrator, leading to a Denial of Service (DoS) and privilege de-escalation by exploiting a business logic vulnerability in versions prior to 2.0.0-beta.2.Grav CMS versions prior to 2.0.0-beta.2 are vulnerable to a privilege de-escalation attack. A low-privileged user with the admin.users.create permission can overwrite the primary administrator account by creating a new user with the same username. Due to an insecure "Create or Update" logic, the system updates the existing account's metadata and permissions instead of rejecting the request. Although the attacker cannot directly elevate their own privileges, they can effectively disable administrative accounts, leading to a complete loss of management control over the CMS. This vulnerability was addressed in Grav core on April 24, 2026, with commit d904efc33.

Attack Chain

  1. An administrator creates a low-privileged user (e.g., adminuser) and grants them the admin.users.create permission.
  2. The low-privileged user logs into the Grav Admin Panel.
  3. The user navigates to the user creation page.
  4. The user fills out the "Add User" form, using the username of an existing administrator account (e.g., root0).
  5. The user submits the form, which triggers the vulnerable UserObject::save function.
  6. The system overwrites the administrator account's configuration file (e.g., user/accounts/root0.yaml) with the provided details, effectively stripping the administrator's permissions.
  7. The administrator attempts to log in, but their account now has reduced or no administrative privileges.
  8. The attacker has effectively achieved privilege de-escalation, causing a denial of service for the administrator.

Impact

Successful exploitation of this vulnerability allows a low-privileged user to disable all administrative accounts in the Grav CMS. This leads to a complete loss of management control over the CMS, potentially impacting any Grav installation where non-admin users are granted permission to create other users. The vulnerability has been assigned CVE-2026-42609 with a severity rating of High.

Recommendation

  • Upgrade Grav CMS to version 2.0.0-beta.2 or later to address the vulnerability described in this brief.
  • Review user permissions and restrict admin.users.create permissions to trusted users only, particularly in versions prior to 2.0.0-beta.2.
  • Monitor webserver logs for unusual user creation requests, specifically attempts to create users with existing administrator usernames using the Sigma rule provided below.
  • Audit user accounts regularly to detect any unauthorized changes in permissions.
]]>highadvisoryprivilege-escalationdenial-of-serviceweb-application