Technical impact
The vulnerability arises from user overwrite logic in the Grav Admin Panel. A user granted only account‑creation permissions can replay a request using an existing username, causing the system to update that account’s metadata and permissions rather than rejecting it. The attacker thereby can overwrite the primary administrator, which results in denial of administrative functions and a downgrade of the root account’s privileges. The flaw is classified as a business‑logic flaw that permits unauthorized privilege modification.
Affected Systems
Getgrav Grav is affected; any installation running a version older than 2.0.0‑beta.2 is vulnerable. The problem was identified before the 2.0.0‑beta.2 release, which includes the fix. No other products or subsidiary versions are listed.
Risk and Exploitability
The CVSS base score of 8.1 indicates high severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. The likely attack vector is a low‑privileged user with account‑creation rights within the same system who can interact with the Grav Admin Panel. Exploit requires no special network access beyond what a legitimate user already has, making the risk moderate to high for environments that allow untrusted user creation.
Github GHSA