CVE-2026-100670: Grav CMS Privilege Escalation Vulnerability

CVE-2026-100670 Overview

CVE-2026-100670 is a privilege escalation vulnerability in Grav CMS versions 2.0.14 through 2.0.24. The flaw exists in the group and account blueprints used by the flex accounts backend. An authenticated backend operator holding admin.users but not admin.super can bypass the blueprint access guard and grant themselves super-admin rights. The vulnerability is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key]. Grav released a fix in version 2.0.25.

Critical Impact
Successful exploitation grants full super-admin control over Grav CMS, including site configuration, plugin and theme installation, the file manager, and every user account.

Affected Products

Grav CMS 2.0.14
Grav CMS versions 2.0.15 through 2.0.23
Grav CMS 2.0.24

Discovery Timeline

2026-09-26 - CVE-2026-100670 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100670

Vulnerability Analysis

The weakness lives in how Grav's blueprint system resolves access-control keys submitted from the admin backend. Blueprints gate sensitive fields such as the access map with a security@: admin.super guard. The guard matches field paths exactly, so it protects the nested form access[admin][super] but ignores semantically equivalent flat keys. Attackers exploit this gap by submitting the dotted key access.admin.super instead of the nested structure.

Because no blueprint rule matches the flat key, BlueprintSchema::filterArray() does not strip it. The value then flows into FlexObject::update(), which calls setNestedProperty(). That helper splits on the . character and reconstructs the nested path, writing the elevated permission into the user or group record. The exploit requires only authenticated access with the admin.users permission, giving backend operators who manage accounts a path to full administrative control.

Root Cause

The root cause is inconsistent key normalization between the blueprint guard layer and the persistence layer. The guard enforces policy against the submitted key path verbatim, while setNestedProperty() interprets dots as hierarchy separators. This mismatch allows a disabled nested field to be reached through an unprotected flat alias.

Attack Vector

Exploitation requires an authenticated session in the Grav admin interface with the admin.users capability. The attacker submits a modified account or group save request containing the field access.admin.super set to true. After submission, the operator either reauthenticates or acts under the newly promoted group membership to use super-admin functionality, including arbitrary file writes through the file manager and plugin installation. See the VulnCheck Privilege Escalation Advisory for request-level details.

Detection Methods for CVE-2026-100670

Indicators of Compromise

Account or group YAML files under user/accounts/ or user/groups/ containing an admin.super: true entry that was not provisioned by an existing super-admin.
Admin backend POST requests to account or group save endpoints whose body includes the literal parameter access.admin.super.
Unexpected installation of plugins or themes, or changes to system.yaml, shortly after a privilege change event.

Detection Strategies

Audit all account and group blueprint files for admin.super grants and reconcile against an approved super-admin roster.
Inspect web server and application logs for admin form submissions containing dot-notation permission keys such as access.admin.*.
Monitor for new admin sessions originating from accounts that previously held only admin.users.

Monitoring Recommendations

Enable file integrity monitoring on user/accounts/, user/groups/, user/config/, and the plugin and theme directories.
Forward Grav admin access logs to a central analytics platform and alert on permission mutation patterns.
Track EPSS trend data for CVE-2026-100670 to prioritize response as exploitation likelihood changes.

How to Mitigate CVE-2026-100670

Immediate Actions Required

Upgrade Grav CMS to version 2.0.25 or later, which drops dotted keys whose ancestor path is disabled or marked validate.ignore.
Review all accounts and groups for unauthorized admin.super grants and revoke any that cannot be attributed to a legitimate administrator.
Rotate credentials and session tokens for every backend operator holding admin.users.

Patch Information

Grav 2.0.25 resolves CVE-2026-100670. Refer to the GitHub Security Advisory GHSA-mwjj-r7vm-pgqm for the upstream patch and release notes.

Workarounds

Temporarily restrict the admin.users permission to trusted super-admin personnel until the upgrade is applied.
Place the admin interface behind network restrictions such as VPN or IP allowlists to limit who can reach the vulnerable endpoints.
Add a reverse proxy rule that rejects admin form submissions containing parameter names matching access\..*\..*.

bash

# Example: upgrade Grav CMS to the patched release
cd /path/to/grav
bin/gpm selfupgrade
bin/grav clear-cache