CVE-2026-75837

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.14

Description An issue exists where the access field in the core group blueprint is not properly guarded by the security@: admin.super restriction. This allows a delegated admin.users operator to escalate their privileges to super-admin by saving a group with the access[admin][super] variable set to true. Upon escalation, the user gains capabilities for scheduler management and Twig evaluation, which is a template engine used to generate HTML.

Recommendations Update Grav to version 2.0.14 or later.