CVE-2026-42609
Description
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the request. This leads to a Denial of Service (DoS) on administrative functions and Privilege De-escalation of the root account. This vulnerability is fixed in 2.0.0-beta.2.
How to fix
- getgrav/grav2.0.0-beta.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| getgrav grav | v ≤ 1.8.0, 2.0.0 | — |
| getgrav/gravPackagist | v < 2.0.0-beta.2 | 2.0.0-beta.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.