{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-74907/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-75837"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grav (\u003c= 2.0.12)","grav (\u003c= 2.0.14)","grav (\u003c= 2.0.15)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","cms","vulnerability","web-application-vulnerability","path-traversal","cve-2026-74907","twig","security-misconfiguration"],"_cs_type":"advisory","_cs_vendors":["getgrav"],"content_html":"\u003cp\u003eGrav version 2.0.12 and earlier contains a privilege escalation vulnerability within its Flex group management functionality. The core group blueprint file located at \u003ccode\u003esystem/blueprints/user/group.yaml\u003c/code\u003e omits a mandatory \u003ccode\u003esecurity@: admin.super\u003c/code\u003e guard on the group access field. In the Grav Flex architecture, the \u003ccode\u003esecurity@\u003c/code\u003e guard is the primary mechanism that flags fields for exclusion during the data save path for non-super users.\u003c/p\u003e\n\u003cp\u003eBecause this guard is missing from the group blueprint, a delegated administrator holding only \u003ccode\u003eadmin.users.update\u003c/code\u003e permissions can successfully submit a request to update a group's access map. By injecting \u003ccode\u003eadmin.super: true\u003c/code\u003e into the group's access configuration, the attacker effectively grants the 'super-admin' role to all members of that group. This escalation provides full administrative control over the application, including access to the scheduler, which can be leveraged for Remote Code Execution (RCE) via cron jobs, and potential Twig template evaluation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial Access: The attacker authenticates as a user with \u003ccode\u003eadmin.users.update\u003c/code\u003e permissions, which is typically granted to delegated administrators responsible for user management.\u003c/li\u003e\n\u003cli\u003eDiscovery: The attacker identifies that they can modify group access configurations, as the application exposes groups at the \u003ccode\u003eadmin.users:crudl\u003c/code\u003e path, which the attacker has permission to update.\u003c/li\u003e\n\u003cli\u003eForm Submission: The attacker sends a \u003ccode\u003ePOST\u003c/code\u003e request to the \u003ccode\u003e/admin/accounts/groups/\u003c/code\u003e endpoint, embedding the malicious payload \u003ccode\u003eaccess[admin][super]=true\u003c/code\u003e within the group update data.\u003c/li\u003e\n\u003cli\u003eBlueprint Bypass: The system's \u003ccode\u003eBlueprint::dynamicSecurity\u003c/code\u003e check fails to flag the \u003ccode\u003eaccess\u003c/code\u003e field as restricted because the \u003ccode\u003egroup.yaml\u003c/code\u003e blueprint lacks the required \u003ccode\u003esecurity@: admin.super\u003c/code\u003e declaration.\u003c/li\u003e\n\u003cli\u003eValidation Bypass: The \u003ccode\u003eBlueprintSchema::filterArray\u003c/code\u003e and \u003ccode\u003eValidation::filterArray\u003c/code\u003e logic processes the payload and retains the restricted \u003ccode\u003eadmin.super\u003c/code\u003e key because the input is not marked for filtering.\u003c/li\u003e\n\u003cli\u003ePersistence: The application saves the unauthorized access configuration to \u003ccode\u003euser://config/groups.yaml\u003c/code\u003e via the \u003ccode\u003eFlexObject::update()\u003c/code\u003e path without further authorization checks.\u003c/li\u003e\n\u003cli\u003ePrivilege Escalation: Upon the next request, the \u003ccode\u003eUserGroupObject::authorize('admin.super')\u003c/code\u003e method evaluates the modified group ACL and returns true, promoting the attacker to full super-admin status.\u003c/li\u003e\n\u003cli\u003eImpact: The attacker utilizes the escalated super-admin privileges to access the administrative dashboard, modify scheduler tasks, or execute malicious Twig templates to achieve RCE.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative control (C:H/I:H/A:H) over the Grav instance. The attacker gains the ability to manage all users, execute arbitrary code via the scheduler, and modify system files. This vulnerability affects all Grav versions up to and including 2.0.12.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security and IT operations teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Grav to version 2.0.14 or later immediately to incorporate the required blueprint security guards.\u003c/li\u003e\n\u003cli\u003eAudit existing \u003ccode\u003euser://config/groups.yaml\u003c/code\u003e files for any unauthorized \u003ccode\u003eadmin.super: true\u003c/code\u003e entries in group access maps.\u003c/li\u003e\n\u003cli\u003eReview all users currently holding the \u003ccode\u003eadmin.users\u003c/code\u003e role to identify accounts that should not have the ability to modify group permissions.\u003c/li\u003e\n\u003cli\u003eUse server-side web application logs to monitor for unauthorized \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003e/admin/accounts/groups/\u003c/code\u003e originating from non-super-admin accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T01:12:31Z","date_published":"2026-09-18T01:10:51Z","id":"https://feed.craftedsignal.io/briefs/2026-09-grav-privilege-escalation/","summary":"A missing 'security@' guard in Grav's group blueprint allows an 'admin.users' operator to escalate privileges to 'admin.super' by modifying group access configurations.","title":"Grav Privilege Escalation via Group Blueprint ACL Bypass","url":"https://feed.craftedsignal.io/briefs/2026-09-grav-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-74907","version":"https://jsonfeed.org/version/1.1"}