CVE-2026-42609: Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

Vulnerability summary

CVE-2026-42609 is a high (CVSS 8.1) Improper Privilege Management vulnerability in getgrav grav. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 11-05-2026
   PublishedVulnerability first disclosed.
2. 14-05-2026
   Last modifiedVulnerability information updated.

Description

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the request. This leads to a Denial of Service (DoS) on administrative functions and Privilege De-escalation of the root account. This vulnerability is fixed in 2.0.0-beta.2.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
• CWE-837Improper Enforcement of a Single, Unique ActionThe product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.