CVE-2026-42609

Summary

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the request. This leads to a Denial of Service (DoS) on administrative functions and Privilege De-escalation of the root account. This vulnerability is fixed in 2.0.0-beta.2.

Affected Software

VendorProductVersion RangeStatus
getgravgrav< 2.0.0-beta.2affected

Weaknesses

  • CWE-269: CWE-269: Improper Privilege Management
  • CWE-285: CWE-285: Improper Authorization
  • CWE-639: CWE-639: Authorization Bypass Through User-Controlled Key
  • CWE-837: CWE-837: Improper Enforcement of a Single, Unique Action

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

Additional References

References