CVE-2026-42609

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-42609
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the request. This leads to a Denial of Service (DoS) on administrative functions and Privilege De-escalation of the root account. This vulnerability is fixed in 2.0.0-beta.2.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663 Patch
https://github.com/getgrav/grav/commit/c66dfeb5ff679a1667678c6335eb9ff3255dfc47 Patch
https://github.com/getgrav/grav/commit/d904efc33e03ebb597afde8d3368b28cf0423632 Patch
https://github.com/getgrav/grav/security/advisories/GHSA-rr73-568v-28f8 Exploit Patch Vendor Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-rr73-568v-28f8 Exploit Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*
cpe:2.3:a:getgrav:grav:2.0.0:beta1:*:*:*:*:*:*
History

14 May 2026, 18:16

Type Values Removed Values Added
References () https://github.com/getgrav/grav/security/advisories/GHSA-rr73-568v-28f8 - Exploit, Patch, Vendor Advisory () https://github.com/getgrav/grav/security/advisories/GHSA-rr73-568v-28f8 - Exploit, Patch, Vendor Advisory

12 May 2026, 16:16

Type Values Removed Values Added
First Time Getgrav grav
Getgrav
CPE cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*
cpe:2.3:a:getgrav:grav:2.0.0:beta1:*:*:*:*:*:*
References () https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663 - () https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663 - Patch
References () https://github.com/getgrav/grav/commit/c66dfeb5ff679a1667678c6335eb9ff3255dfc47 - () https://github.com/getgrav/grav/commit/c66dfeb5ff679a1667678c6335eb9ff3255dfc47 - Patch
References () https://github.com/getgrav/grav/commit/d904efc33e03ebb597afde8d3368b28cf0423632 - () https://github.com/getgrav/grav/commit/d904efc33e03ebb597afde8d3368b28cf0423632 - Patch
References () https://github.com/getgrav/grav/security/advisories/GHSA-rr73-568v-28f8 - () https://github.com/getgrav/grav/security/advisories/GHSA-rr73-568v-28f8 - Exploit, Patch, Vendor Advisory

11 May 2026, 16:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-11 16:17

Updated : 2026-05-14 18:16

NVD link : CVE-2026-42609

Mitre link : CVE-2026-42609

CVE.ORG link : CVE-2026-42609

JSON object : View

Products Affected

getgrav

  • grav
CWE
CWE-269

Improper Privilege Management

CWE-285

Improper Authorization

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-837

Improper Enforcement of a Single, Unique Action