Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Grav lets low‑privilege API users create admin accounts

CVE-2026-42844 · published 5 months ago
Summary

In the Grav platform, a user who can only upload media through the API can abuse a specific upload function to place a custom file that creates a new user with full admin rights. This gives that person complete control over the Grav API. Upgrade to the latest API version that includes the fix.

What to do
  • Update getgrav grav to version 2.0.0-beta.4.
  • Update getgrav getgrav/grav to version 2.0.0-beta.4.
Affected software
Ecosystem VendorProductAffected versions
composer getgrav grav < 2.0.0-beta.4
Fix: upgrade to 2.0.0-beta.4
Packagist getgrav getgrav/grav < 2.0.0-beta.4
Fix: upgrade to 2.0.0-beta.4
– getgrav grav 2.0.0
cpe:2.3:a:getgrav:grav:2.0.0:beta2:*:*:*:*:*:*
Original advisory text
Grav: Low-privileged API users can create super-admin accounts via blueprint-upload
Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
CWE-434Unrestricted File Upload
Timeline
Published12 May 2026
Updated4 Nov 2026
First seen6 May 2026
Sources
GHSA-6xx2-m8wv-756h · GHSA
CVE-2026-42844 · NVD
GHSA-6xx2-m8wv-756h · OSV
CVE-2026-42844 · OSV
Track software like this
Free during beta