⚠ Withdrawn by GitHub Security Advisories

Withdrawn: September 17, 2026

GHSA-m97h-2qj3-5773CriticalCVSS 9.1Disclosed before NVD

Duplicate Advisory: Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Published
August 18, 2026
Last Modified
September 17, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-xhfv-7758-r9hx. This link is maintained to preserve external references.

Original Description

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.

🎯 Affected products1

  • composer/getgrav/grav:< 2.0.14

🔗 References (4)