Grav CMS CVE-2026-100670

Requires an authenticated backend account on the Grav 2.0 flex accounts backend that already holds the admin.users permission but not admin.super - i.e., a delegated/sub-administrator. Exploitation uses the group or account blueprints and depends on the version-specific flat-key handling present in 2.0.14 through 2.0.24; installs on 2.0.25+ or on older 1.x lines outside this range are not affected. What limits exploitation: the attacker must already have privileged (though non-super) backend access, so this is an insider or post-compromise privilege-escalation vector rather than a remote unauthenticated one; no user interaction is required.

This is a genuine, high-value privilege escalation, not a high-CVSS-but-low-real-risk issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.7) is well-supported: the attack is network-reachable through the standard flex-accounts backend, has low complexity (a single crafted flat-key form submission), needs no user interaction, and yields full super-admin control over configuration, plugin/theme installation, the file manager, and all accounts. The only meaningful gate is PR:L - the attacker must already be an authenticated backend operator holding admin.users. No EPSS score, KEV entry, or public POC is present in the provided data, so exploitation status is: no public exploit identified at time of analysis. There is no conflict between the CVSS vector and the description - both agree on authenticated network access. The main caveat is that the impact is contingent on an insider or a compromised sub-admin account rather than a fully unauthenticated attacker, which lowers the population of realistic attackers even though technical impact is total. Net: real priority for any Grav 2.0 deployment with delegated (non-super) admin accounts.

A backend operator granted only admin.users (e.g., a delegated account manager) opens the flex accounts editor and submits a flat dot-notation key such as access.admin.super=true for their own account or a group they belong to. The blueprint's security@ admin.super guard resolves only the exact nested path and never matches the flattened key, so it survives filtering and is reconstructed into the nested access map on save, promoting the operator to full super-admin. No public exploit code is identified, but the technique is fully described and trivially reproducible.