CVEFinder.io

CVE-2026-42609

⚠️ high
🔍 Scan for this CVE
Summary

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the request. This leads to a Denial of Service (DoS) on administrative functions and Privilege De-escal

Description

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the request. This leads to a Denial of Service (DoS) on administrative functions and Privilege De-escalation of the root account. This vulnerability is fixed in 2.0.0-beta.2.

CVSS Score
8.1
High
EPSS Score
0.0
Exploit Probability
Published Date
2026-05-11
First Seen: 2026-05-12
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 77.6% of all 321,566 vulnerabilities in our database.

#72,014
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 14, 2026
🔍 Exploitation Status
Poc
Proof-of-concept available
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-05-14
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

📦 Affected Products 2

🔗 References 4

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-42844 ⚠️ high 8.8 0.0 Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write ca... 2026-05-12
CVE-2026-44738 ⚠️ high 7.7 0.0 Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.page... 2026-05-11
CVE-2026-29924 ⚠️ high 7.6 0.1 Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the a... 2026-03-30
CVE-2021-47812 ⛔ critical 9.8 0.3 GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configurat... 2026-01-16
CVE-2025-66843 🔶 medium 5.4 0.0 grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An... 2025-12-15
CVE-2025-66844 ⛔ critical 9.1 0.1 In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is ... 2025-12-15
These CVEs affect the same products