Grav CMS versions 2.0.14 through 2.0.24 contain a flaw in group and account blueprints that allows a logged‑in backend operator with only admin.users rights to create a dotted flat key such as access.admin.super. Because the blueprint guard checks the exact path, the dotted key bypasses the security guard, survives filtering, and is written to the backend, giving the user or a group admin.super permissions. The bug is a classic case of Missing Authorization and is catalogued as CWE‑639. The result is that the attacker can elevate privileges to full super‑admin, gaining control over configuration, plugin and theme installation, the file manager, and all user accounts.

The affected product is Grav CMS provided by the vendor getgrav, specifically any release from 2.0.14 up to and including 2.0.24. No other versions are impacted, and the vulnerability is tied to the Flex accounts backend mechanism that handles user and group data.

The CVSS score of 8.7 places this vulnerability in the High severity range, indicating that once exploited it can compromise the entire CMS installation. The EPSS score is not available, so an exact exploitation probability cannot be assigned, but the lack of external constraints means that an authenticated backend user who can modify account data is sufficient to trigger the flaw. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation reports yet, but the high score and easy attack path make it a compelling priority. The fix is implemented in Grav 2.0.25, which removes support for dotted keys whose parent paths are disabled or marked validate.ignore.