Kurz gesagt
- CVE-2025-66296 ist eine Schwachstelle (HOCH (CVSS 8.8)) in getgrav/grav, grav (getgrav).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.34%, höher als bei 27.6% aller Schwachstellen.
- Abhilfe: auf 1.8.0-beta.27, 1.8.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| getgrav/grav Packagist | < 1.8.0-beta.27
| 1.8.0-beta.27
|
| grav | = 1.8.0≥ 1.7.49.5, < 1.8.0
| 1.8.0
|
Description
Summary
A privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users.
A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator. This effectively allows privilege escalation from limited user-manager permissions to full administrator access.
Steps to Reproduce
- Make sure you have two accounts: an admin and a user with create user privilege
- In the user account, navigate to /grav-admin/admin/accounts/users and click "Add"
- Enter the name of the admin, complete registration and observe that the existing admin’s email is changed to the value you provided.
- Log out from user account log in as admin with new credentials
Impact
- Full admin takeover by any user with create user permission.
- Ability to change admin credentials, install/remove plugins, read or modify site data, and execute any action available to an admin.
- Severity: High/Critical.
PoC
https://github.com/user-attachments/assets/3ab0a7d6-5055-41be-9e0e-2bd6ca359b37
NVD description
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator. This effectively allows privilege escalation from limited user-manager permissions to full administrator access. This vulnerability is fixed in 1.8.0-beta.27.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free