CVE-2026-75837: Grav CMS Privilege Escalation Vulnerability

CVE-2026-75837 Overview

CVE-2026-75837 is a privilege escalation vulnerability in Grav content management system (CMS) versions prior to 2.0.14. The flaw resides in the core group blueprint, which fails to guard the access field with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true, elevating themselves to super-admin. Once escalated, the attacker gains scheduler and Twig template evaluation capabilities, enabling arbitrary command execution on the underlying host. The weakness is categorized as [CWE-269] Improper Privilege Management.

Critical Impact
A low-privileged administrator can escalate to super-admin and achieve remote code execution through Grav's scheduler and Twig evaluation features.

Affected Products

Grav CMS versions before 2.0.14
Grav Admin plugin deployments exposing delegated admin.users operators
Self-hosted Grav installations with multi-tier administrator roles

Discovery Timeline

2026-08-18 - CVE-2026-75837 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75837

Vulnerability Analysis

Grav implements a role delegation model where operators can be granted narrow permissions such as admin.users to manage user and group records. Group definitions are validated against a blueprint file that declares which fields require elevated authorization. The core group blueprint omits the security@: admin.super guard on the access field. This omission allows any operator with permission to write group configurations to assign arbitrary access rights, including admin.super.

An attacker who controls a user account belonging to a modified group inherits the escalated permissions on their next authenticated action. Super-admin privileges unlock the scheduler subsystem, which executes shell commands defined in YAML configuration. Super-admin also unlocks Twig template evaluation in page content, which renders server-side PHP-backed expressions. Either path yields remote code execution on the web server.

Root Cause

The root cause is a missing field-level authorization check in the group blueprint schema. Grav's blueprint system supports the security@ directive to require a specific permission before a field can be modified. Because the access field lacked this directive, permission validation was enforced only at the coarse admin.users scope rather than at the sensitive sub-key level.

Attack Vector

The attack is remote and requires an authenticated session with the delegated admin.users permission. The attacker submits a group save request containing access[admin][super]=true through the admin interface or its underlying API. After assigning their user to the modified group, they invoke scheduler jobs or author a Twig-enabled page to execute arbitrary code. No user interaction beyond the attacker's own actions is required. See the GitHub Security Advisory and VulnCheck Privilege Escalation Advisory for additional technical details.

Detection Methods for CVE-2026-75837

Indicators of Compromise

Modifications to group YAML files under user/groups/ that set access.admin.super: true outside of change-management windows
Unexpected new or modified scheduler jobs in user/config/scheduler.yaml invoking shell commands
Twig expressions such as {{ system(...) }} or {{ shell_exec(...) }} appearing in page markdown files
Admin audit log entries showing group edits by operators without a prior super-admin role

Detection Strategies

Compare group blueprint files against known-good baselines and alert when access keys change unexpectedly.
Correlate admin.users operator sessions with subsequent scheduler configuration writes or Twig template edits.
Monitor the Grav admin API for POST requests to group endpoints containing the access[admin][super] parameter.

Monitoring Recommendations

Enable filesystem integrity monitoring on user/groups/, user/accounts/, and user/config/scheduler.yaml.
Ship Grav admin logs to a central SIEM and alert on privilege changes performed by non-super-admin accounts.
Track process creation on the web server for PHP-spawned shells that correlate with scheduler execution windows.

How to Mitigate CVE-2026-75837

Immediate Actions Required

Upgrade Grav to version 2.0.14 or later on all instances, including staging and disaster-recovery environments.
Audit all existing groups for unauthorized access.admin.super: true entries and remove them.
Review the roster of accounts holding admin.users and revoke the permission where operational need is not demonstrated.
Rotate credentials and API tokens for any account that could have exercised the flaw before patching.

Patch Information

The maintainers addressed the issue in Grav 2.0.14 by adding the security@: admin.super directive to the access field in the core group blueprint. Details are published in the GitHub Security Advisory GHSA-xhfv-7758-r9hx.

Workarounds

Restrict the admin.users permission to trusted operators only until the upgrade is applied.
Apply a local blueprint override that adds security@: admin.super to the access field for group definitions.
Disable the scheduler and Twig-in-pages features in system.yaml to reduce the exploitation impact of any successful escalation.

bash

# Configuration example
# Verify the installed Grav version and upgrade
php bin/grav --version
php bin/gpm selfupgrade
php bin/gpm update

# Audit groups for unauthorized super-admin access
grep -R "super:\s*true" user/groups/