A missing security@: admin.super restriction in Grav's core group blueprint lets a delegated admin.users operator grant themselves super-admin, earning a CVSS 3.1 score of 9.1 (Critical).
What Is It
Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. Because the field is unprotected, a delegated admin.users operator can save a group with access[admin][super]=true and escalate to super-admin. The flaw is classified as CWE-269 (Improper Privilege Management) and was disclosed via VulnCheck.
Why It Matters
Escalation to super-admin unlocks Grav's scheduler and Twig evaluation capabilities; a direct path from delegated user management to full control of the application. The vulnerability carries a CVSS 3.1 base score of 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H: network-reachable, low attack complexity, no user interaction, changed scope, and high impact across confidentiality, integrity, and availability. A secondary CVSS 4.0 assessment rates it 9.3 (Critical).
The practical threshold is an existing delegated admin account. Any Grav deployment that hands out admin.users to non-super operators, agencies, multi-tenant sites, editorial teams, has effectively handed out super-admin.
What's Vulnerable
- Vendor: getgrav
- Product: Grav
- Affected: all versions before 2.0.14 (semver, default status unaffected)
- Fixed: 2.0.14 and later
Patch Status
Upgrade to Grav 2.0.14, which restores the security@: admin.super guard on the group blueprint's access field. There is no CISA KEV entry for this CVE, no confirmed active exploitation and no federal required-action deadline at this time. NVD lists the record as Received as of 2026-08-18, so enrichment and CPE data are still pending. Until patching is possible, audit which accounts hold admin.users and review existing groups for unexpected admin.super grants.