Grav CMS Privilege Escalation Vulnerability
- Severity
- HIGH
- Affected component
- composer/getgrav/grav (packagist)
- Patched version
- 2.0.14
An early warning has been issued for a critical vulnerability in Grav CMS. Versions before 2.0.14 are reportedly affected.
What happened
An early warning has been issued for a critical vulnerability in Grav CMS. Versions before 2.0.14 are reportedly affected. The vulnerability, tracked as GHSA-M97H-2QJ3-5773 and GHSA-XHFV-7758-R9HX, allows a delegated admin.users operator to escalate privileges to super-admin due to a missing guard on the access field in the core group blueprint. This issue has been flagged since August 18, 2026, and is under investigation.
The affected component is composer/getgrav/grav with reported affected versions less than 2.0.14. The patched version is 2.0.14. There is no evidence that this vulnerability has been exploited in the wild. Users are advised to upgrade to mitigate the risk.
What to do about it
- Upgrade Grav CMS to version 2.0.14 or later to mitigate the privilege escalation vulnerability.
- Review your Grav CMS installation to ensure it is running a patched version.
- Monitor the primary sources for updates on this vulnerability.
How 0Day would have caught this
composer/getgrav/grav is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Grav CMS version less than 2.0.14, you are reportedly affected by this vulnerability.
What should I do right now?
Upgrade to Grav CMS version 2.0.14 or later to mitigate the vulnerability.
Is there an official fix available?
Yes, Grav CMS version 2.0.14 is the patched version.