Em resumo
- CVE-2025-66296 é uma vulnerabilidade ALTO (CVSS 8.8) que afeta getgrav/grav, grav (getgrav).
- Chance de exploração nos próximos 30 dias (EPSS): 0.34%, maior que 27.6% das vulnerabilidades.
- Correção: atualize para 1.8.0-beta.27, 1.8.0 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| getgrav/grav Packagist | < 1.8.0-beta.27
| 1.8.0-beta.27
|
| grav | = 1.8.0≥ 1.7.49.5, < 1.8.0
| 1.8.0
|
Description
Summary
A privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users.
A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator. This effectively allows privilege escalation from limited user-manager permissions to full administrator access.
Steps to Reproduce
- Make sure you have two accounts: an admin and a user with create user privilege
- In the user account, navigate to /grav-admin/admin/accounts/users and click "Add"
- Enter the name of the admin, complete registration and observe that the existing admin’s email is changed to the value you provided.
- Log out from user account log in as admin with new credentials
Impact
- Full admin takeover by any user with create user permission.
- Ability to change admin credentials, install/remove plugins, read or modify site data, and execute any action available to an admin.
- Severity: High/Critical.
PoC
https://github.com/user-attachments/assets/3ab0a7d6-5055-41be-9e0e-2bd6ca359b37
NVD description
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator. This effectively allows privilege escalation from limited user-manager permissions to full administrator access. This vulnerability is fixed in 1.8.0-beta.27.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free