Grav CMS: Critical Privilege Escalation and XSS Flaws Disclosed Together
Key findings • Critical privilege escalation vulnerability (CVE-2026-75837) allows delegated admins to gain super-admin access. • Two vulnerabilities in the Grav API plugin include missing au…
Key findings
- Critical privilege escalation vulnerability (CVE-2026-75837) allows delegated admins to gain super-admin access.
- Two vulnerabilities in the Grav API plugin include missing authorization and path traversal.
- Stored XSS vulnerability (CVE-2026-75828) allows authenticated editors to inject malicious scripts.
- Affected Grav core versions are below 2.0.15; API plugin versions below 1.0.15.
On August 18, 2026, a batch of four vulnerabilities was disclosed for the Grav content management system, with a critical-severity flaw allowing for privilege escalation. The vulnerabilities, disclosed on the same day, highlight security weaknesses in both the Grav core and its API plugin.
One critical vulnerability, CVE-2026-75837 (CVSSv3 9.1), allows a delegated administrator to escalate their privileges to super-admin. This is achieved by exploiting a lack of proper access control in the core group blueprint, specifically by saving a group with access[admin][super]=true. This escalation grants the attacker capabilities such as scheduler and Twig evaluation.
The Grav API plugin (getgrav/grav-plugin-api) is affected by two separate vulnerabilities. CVE-2026-75835 (CVSSv3 4.3) is a medium-severity missing authorization flaw in the userPassesAuthorize() function. It fails to properly scope API key permissions, allowing authenticated users to bypass intended restrictions. Additionally, CVE-2026-75830 (CVSSv3 7.1), a high-severity path traversal vulnerability, exists in the PagesController::batchCopy() method. An incomplete fix for a previous issue left the 'suffix' parameter unvalidated, enabling authenticated users to traverse directories.
A high-severity stored cross-site scripting (XSS) vulnerability, CVE-2026-75828 (CVSSv3 8.7), was also disclosed. This flaw resides in the detectXss() function within Grav core. Unpaired quotes in unquoted attribute values can bypass event-handler detection, allowing authenticated editors to inject malicious scripts, such as onerror=, which execute in visitor browsers when page content is rendered.
The critical privilege escalation vulnerability (CVE-2026-75837) and the stored XSS vulnerability (CVE-2026-75828) were fixed in Grav versions prior to 2.0.15. The API plugin vulnerabilities (CVE-2026-75835 and CVE-2026-75830) were addressed in API plugin versions prior to 1.0.15. Users are strongly advised to update to the latest versions to mitigate these risks.
This coordinated disclosure of multiple vulnerabilities, including a critical privilege escalation flaw, underscores the importance of timely patching for Grav installations. Administrators should prioritize updating both the Grav core and the API plugin to secure their systems against these newly identified threats.