Grav Admin Panel Vulnerability Allows Account Takeover via Low-Privilege User

A critical business logic vulnerability, identified as CVE-2026-42609, exists in the Grav web platform’s Admin Panel. According to the National Vulnerability Database, this flaw, present in versions prior to 2.0.0-beta.2, allows a low-privileged user to overwrite existing accounts. Specifically, a user with only ‘user creation’ permissions can create a new user with an already existing username.

Instead of rejecting the duplicate username, the system incorrectly updates the existing account’s metadata and permissions. This fundamental design flaw can be exploited to overwrite even the primary administrator’s account, leading to a complete Denial of Service (DoS) for administrative functions and a severe Privilege De-escalation of the root account. The National Vulnerability Database assigned this a CVSS score of 8.1 (HIGH), underscoring the significant impact.

This isn’t a complex exploit; it leverages basic business logic failure. Attackers don’t need advanced skills to pull this off. Defenders need to recognize that even ‘low-privileged’ access can be weaponized into full administrative control when core identity management logic is broken. The fix is available in Grav version 2.0.0-beta.2, addressing the underlying issue.