Which versions of Grav CMS are affected by EUVD-2026-60601?

Grav CMS versions before 2.0.14 contain a privilege escalation vulnerability that allows delegated administrators with limited permissions to escalate to full super-admin access and execute arbitrary…. A patch is available.

How to fix or mitigate EUVD-2026-60601?

Within 24 hours, inventory all Grav CMS deployments and their current versions; immediately audit accounts holding admin.users permissions and review administrative action logs for unauthorized group modifications. Within 7 days, upgrade all installations to Grav CMS 2.0.14 or later per the vendor GHSA advisory. Within 30 days, conduct forensic analysis of system audit trails covering the vulnerable period to identify any unauthorized super-admin account promotions, task scheduler activations, or template evaluation execution.

Grav CMS EUVD-2026-60601

Q: What is the CVSS score of EUVD-2026-60601?

EUVD-2026-60601 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-75837 CRITICAL

Improper Privilege Management (CWE-269)

2026-08-18 VulnCheck

GHSA-m97h-2qj3-5773

Privilege Escalation Grav

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Requires an authenticated delegated admin.users operator so PR:H, not PR:N; network admin panel with low complexity and no user interaction, yielding full C/I/A impact via resulting super-admin code execution.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 18, 2026 - 12:02 EUVD

Analysis Generated

Aug 18, 2026 - 11:54 vuln.today

CVE Published

Aug 18, 2026 - 11:19 cve.org

CRITICAL 9.3

DescriptionCVE.org

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.

AnalysisAI

Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users permission promote an account to super-admin by saving a group with access[admin][super]=true. The core group blueprint omits the required security@: admin.super guard on the access field, so the operator inherits full super-admin capabilities including the task scheduler and arbitrary Twig template evaluation - effectively code execution on the host. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated Grav admin account holding the delegated admin.users permission (user/group management rights) but not super-admin, on a Grav instance older than 2.0.14. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.3, but its PR:N is inconsistent with the description, which explicitly requires a 'delegated admin.users operator' - an authenticated, privileged back-end user. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to Grav 2.0.14 or later, which restores the security@: admin.super guard on the group access field; see https://github.com/getgrav/grav/security/advisories/GHSA-xhfv-7758-r9hx. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Grav CMS deployments and their current versions; immediately audit accounts holding admin.users permissions and review administrative action logs for unauthorized group modifications. …

Threat intelligence, references, and detailed analysis are available after sign-in.