In short
- CVE-2025-66296 is a HIGH (CVSS 8.8) vulnerability affecting getgrav/grav, grav (getgrav).
- Chance of exploitation in the next 30 days (EPSS): 0.34%, higher than 27.6% of all vulnerabilities.
- Fix: update to 1.8.0-beta.27, 1.8.0 or later.
| Package | Affected versions | Patched versions |
|---|
| getgrav/grav Packagist | < 1.8.0-beta.27
| 1.8.0-beta.27
|
| grav | = 1.8.0≥ 1.7.49.5, < 1.8.0
| 1.8.0
|
Description
Summary
A privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users.
A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator. This effectively allows privilege escalation from limited user-manager permissions to full administrator access.
Steps to Reproduce
- Make sure you have two accounts: an admin and a user with create user privilege
- In the user account, navigate to /grav-admin/admin/accounts/users and click "Add"
- Enter the name of the admin, complete registration and observe that the existing admin’s email is changed to the value you provided.
- Log out from user account log in as admin with new credentials
Impact
- Full admin takeover by any user with create user permission.
- Ability to change admin credentials, install/remove plugins, read or modify site data, and execute any action available to an admin.
- Severity: High/Critical.
PoC
https://github.com/user-attachments/assets/3ab0a7d6-5055-41be-9e0e-2bd6ca359b37
NVD description
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator. This effectively allows privilege escalation from limited user-manager permissions to full administrator access. This vulnerability is fixed in 1.8.0-beta.27.
More vulnerabilities in getgrav/grav
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free