CVE-2025-66296: Getgrav Grav Privilege Escalation Flaw

CVE-2025-66296 Overview

CVE-2025-66296 is a high-severity privilege escalation vulnerability in Grav CMS, a popular file-based Web platform. The vulnerability exists in Grav's Admin plugin due to the absence of username uniqueness validation when creating users. An attacker with limited user-manager permissions can exploit this flaw to create a new account using the same username as an existing administrator account, set a new password and email, and subsequently log in as that administrator. This effectively allows vertical privilege escalation from limited user-manager permissions to full administrator access.

Critical Impact

Authenticated users with user creation permissions can take over administrator accounts by exploiting username collision, gaining full administrative control over the Grav CMS installation.

Affected Products

• Grav CMS versions prior to 1.8.0-beta.27
• Grav CMS 1.8.0-beta1 through 1.8.0-beta26
• All Grav installations using the Admin plugin with user management functionality

Discovery Timeline

• 2025-12-01 - CVE-2025-66296 published to NVD
• 2025-12-04 - Last updated in NVD database

Technical Details for CVE-2025-66296

Vulnerability Analysis

This privilege escalation vulnerability (CWE-266: Incorrect Privilege Assignment) carries a CVSS 3.1 score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability requires low privileges (an authenticated user with user creation permissions) and can be exploited remotely over the network with low attack complexity and no user interaction required.

The EPSS (Exploit Prediction Scoring System) score is 0.038%, placing this vulnerability in the 10.97th percentile for exploitation probability. While not currently being actively exploited in the wild, the straightforward nature of the attack makes it a significant risk for unpatched installations.

Root Cause

The root cause of this vulnerability lies in the Admin plugin's user creation functionality, which fails to validate username uniqueness before creating a new user account. When a user with the create user permission attempts to register a new account, the system does not check whether the provided username already exists in the user database. This allows an attacker to create a duplicate entry for an existing administrator's username with attacker-controlled credentials (password and email).

The file-based nature of Grav CMS, where user data is stored in YAML files rather than a traditional database, may contribute to this oversight as the system does not enforce database-level uniqueness constraints typically found in relational database systems.

Attack Vector

The attack vector is network-based and requires authenticated access with user management permissions. The exploitation follows this sequence:

1. An attacker authenticates to the Grav Admin panel with an account that has create user permissions
2. The attacker identifies an existing administrator username (potentially through user enumeration or knowledge of the installation)
3. Using the user creation function, the attacker creates a new account with the same username as the target administrator
4. The attacker sets a new password and email address for this account
5. The attacker logs out and authenticates using the administrator username with the newly created password
6. The attacker now has full administrator privileges

The vulnerability does not require any user interaction from the victim administrator and can be exploited with low complexity. The impact affects confidentiality, integrity, and availability as full administrative access allows complete control over the CMS installation.

Detection Methods for CVE-2025-66296

Indicators of Compromise

• Multiple user account files with the same username in Grav's user/accounts/ directory
• Unexpected password reset or credential change events for administrator accounts
• Administrator login events from unfamiliar IP addresses or at unusual times
• Audit log entries showing user creation attempts with existing usernames

Detection Strategies

Organizations can implement several detection strategies to identify exploitation attempts:

Log Analysis: Monitor Grav Admin panel logs for user creation events. Look for patterns where a new user is created with a username matching an existing account. This anomaly should trigger an immediate alert.

File Integrity Monitoring: Implement file integrity monitoring on the user/accounts/ directory. Alert on any new account files that share names with existing administrator accounts or unexpected modifications to existing account YAML files.

Authentication Monitoring: Track authentication events for administrator accounts and alert on successful logins following user creation events, especially if the login originates from different IP addresses or occurs shortly after account creation.

Access Pattern Analysis: Monitor for users with limited permissions attempting to access administrative functions shortly after user creation events.

Monitoring Recommendations

Security teams should implement continuous monitoring for:

• User creation API calls through the Admin plugin
• Changes to user account files in the Grav installation directory
• Administrator authentication events with correlation to recent user management activities
• Network traffic to the Grav Admin panel from hosts that previously only had limited access

Consider deploying a Web Application Firewall (WAF) to monitor and log requests to the user management endpoints for additional visibility.

How to Mitigate CVE-2025-66296

Immediate Actions Required

• Upgrade Grav CMS to version 1.8.0-beta.27 or later immediately
• Audit existing user accounts for potential duplicate usernames
• Review user creation logs for any suspicious activity prior to patching
• Verify administrator account credentials have not been compromised
• Restrict user creation permissions to only the most trusted users until patching is complete

Patch Information

The vulnerability is fixed in Grav CMS version 1.8.0-beta.27. The fix was implemented in commit 3462d94d575064601689b236508c316242e15741, which adds username uniqueness validation to the user creation process.

Vendor Resources:

• GitHub Security Advisory GHSA-cjcp-qxvg-4rjm
• Patch Commit

To update Grav CMS, administrators can use the built-in update mechanism through the Admin panel or update via GPM (Grav Package Manager) using the command line.

Workarounds

If immediate patching is not possible, implement these temporary mitigations:

Restrict User Creation Permissions: Remove the create user permission from all non-essential accounts. Only the primary system administrator should retain this capability until the patch is applied.

Implement Manual Validation: Before creating any new user accounts, manually verify that the username does not conflict with existing accounts by checking the user/accounts/ directory.

Enhanced Monitoring: Deploy additional logging and monitoring around user creation functions to detect any exploitation attempts while awaiting the patch.

# Check for duplicate usernames in Grav user accounts
cd /path/to/grav/user/accounts/
ls -la *.yaml | awk -F'/' '{print $NF}' | sort | uniq -d

# Monitor account directory for changes
inotifywait -m /path/to/grav/user/accounts/ -e create -e modify