Skip to content
OpenAdvisories
Critical · 9.4 Public exploit CVE-2026-42613 EUVD-2026-29071GHSA-pxm6-mhxr-q4mj

Grav: Privilege Escalation via Missing Server-Side Validation of groups/access

Published May 11, 2026 · Updated May 12, 2026 · Assigned by GitHub_M

Vendor: getgrav Product: grav Package: getgrav/grav Ecosystem: Packagist

Description

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are included in the configured allowed fields list, an unauthenticated user can self-register with admin.super privileges by injecting these fields into the registration request. This vulnerability is fixed in 2.0.0-beta.2.

Affected products

VendorProductAffectedFixed
getgrav grav < 2.0.0-beta.2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist getgrav/grav < 2.0.0-beta.2 2.0.0-beta.2 GHSA-pxm6-mhxr-q4mj

References