Improper privilege management in Grav CMS - CVE-2026-42609

Detailed vulnerability description

The vulnerability allows a remote user to cause a denial of service on administrative functions and de-escalate privileges of an administrative account.

The vulnerability exists due to improper privilege management in the Grav Admin Panel user management module when handling user creation requests with an existing username. A remote user can submit a new user record using the username of an existing administrative account to cause a denial of service on administrative functions and de-escalate privileges of an administrative account.

Exploitation requires an account with permission to create other users.

How to mitigate CVE-2026-42609

Sources

• https://github.com/getgrav/grav/security/advisories/GHSA-rr73-568v-28f8
• https://github.com/getgrav/grav/commit/d904efc33