CVEvulnerability

CVE-2026-42609

8.1 HIGH Published 2026-05-11 Modified 2026-10-26 Official page ↗
Status
Modified
Published
2026-05-11
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-269, CWE-285, CWE-639, CWE-837

Description

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the request. This leads to a Denial of Service (DoS) on administrative functions and Privilege De-escalation of the root account. This vulnerability is fixed in 2.0.0-beta.2.

Affected configurations

• getgrav grav (<= 1.8.0) • getgrav grav 2.0.0

Related

Weakness · CWE (4)

  • CWE-269 Improper Privilege Management weakness
  • CWE-285 Improper Authorization weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-837 Improper Enforcement of a Single, Unique Action weakness

References