Grav CMS Admin Group Privilege Escalation (CVE-2026-75837)

Technical Analysis

The vulnerability stems from Grav's core group blueprint failing to enforce the required security@: admin.super restriction on the access field, meaning any user holding only the admin.users permission can submit a group save request with access[admin][super]=true. This grants the attacker super-admin privileges, unlocking the built-in Twig template evaluation feature and task scheduler, both of which can be abused to execute arbitrary server-side code (effectively an authenticated RCE chain via privilege escalation). Exploitation requires no more than a legitimate low-privilege admin account, making this a high-severity insider or compromised-credential escalation path with a CVSS score of 9.1. Organizations that self-host Grav-based sites or documentation portals used to serve RAG content, agent knowledge bases, or internal tooling dashboards should treat this as a path to full server compromise. If an AI agent framework relies on a Grav-hosted CMS for content retrieval, admin panel access, or webhook-triggered automation, a successful escalation could let attackers plant malicious Twig templates or scheduled tasks that poison agent-ingested content or exfiltrate API keys stored in the Grav environment.

Affected Systems

Grav CMS versions prior to 2.0.14; specifically installations using the admin plugin with delegated admin.users role assignments and the core group blueprint configuration

Indicators of Compromise

• No published file hashes, IPs, or domains available for this vulnerability at time of analysis; indicators would be specific to exploitation attempts (e.g., unexpected group blueprint modifications with access[admin][super]=true, anomalous Twig template edits, or unauthorized scheduler task creation in Grav admin logs)

Remediation Steps

1. 1

   Upgrade Grav CMS

   Update all Grav installations to version 2.0.14 or later, where the access field restriction is properly enforced.

2. 2

   Audit admin.users accounts

   Review all accounts holding the admin.users permission and verify none have been used to modify group blueprints or escalate access levels.

3. 3

   Review group configurations

   Inspect existing group definitions for unauthorized access[admin][super]=true entries and revoke any unwarranted super-admin grants.

4. 4

   Restrict scheduler and Twig features

   Limit access to the Twig template evaluation and scheduler functions to trusted super-admin accounts only, and monitor their usage via logging.

5. 5

   Rotate credentials and API keys

   If compromise is suspected, rotate all admin credentials and any API keys or secrets accessible from the Grav server, particularly those used by connected AI agent or automation systems.