Grav CMS CVE-2026-75837

Requires an authenticated Grav admin account holding the delegated admin.users permission (user/group management rights) but not super-admin, on a Grav instance older than 2.0.14. The concrete trigger is saving a group whose blueprint field access[admin][super] is set to true - possible because the core group blueprint lacks the security@: admin.super restriction. Exploitation is limited to deployments that actually delegate admin.users to non-super-admin operators; a standard single-super-admin install exposes no realistic path because no lower-privileged account with the prerequisite role exists. No end-user interaction and no non-default server configuration are required beyond having such a delegated role.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.3, but its PR:N is inconsistent with the description, which explicitly requires a 'delegated admin.users operator' - an authenticated, privileged back-end user. This is a meaningful discrepancy: it is not an unauthenticated internet-facing flaw but a trust-boundary escalation available only to accounts that already hold delegated user-management rights. Reassessed with PR:H the real severity is High (~7.2) rather than Critical. There is no EPSS score, no POC, and no KEV listing provided, so there is no evidence of active or automated exploitation. Real-world priority is moderate-to-high for Grav deployments that delegate user administration to non-super-admin staff (multi-tenant or agency setups); single-super-admin installs have little exposed surface because the required admin.users role is rarely delegated.

An organization delegates account management to a staff member by granting admin.users but withholding super-admin. That operator edits a group in the admin panel, sets the group's access[admin][super] flag to true, assigns their own account to it, and re-authenticates as a full super-admin - then uses the scheduler or a Twig snippet to run arbitrary code on the server. No public POC is currently identified, but the steps require only standard admin-panel interaction.