What is GHSA-m97h-2qj3-5773?

GHSA-m97h-2qj3-5773 is a security advisory published by GitHub Security Advisories with Critical severity. Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required...

Which CVE IDs does GHSA-m97h-2qj3-5773 cover?

GHSA-m97h-2qj3-5773 covers the following CVE IDs: CVE-2026-75837. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m97h-2qj3-5773?

GHSA-m97h-2qj3-5773 has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-m97h-2qj3-5773CriticalCVSS 9.1

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required...

Vendor

GitHub Security Advisories

Published

August 18, 2026

Last Modified

August 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-75837 →

📋 Description

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.

🔗 References (4)

https://github.com/getgrav/grav/security/advisories/GHSA-xhfv-7758-r9hx
https://nvd.nist.gov/vuln/detail/CVE-2026-75837
https://www.vulncheck.com/advisories/grav-before-privilege-escalation-via-group-access-field
https://github.com/advisories/GHSA-m97h-2qj3-5773