CVE-2026-42613 json
Grav: Privilege Escalation via Missing Server-Side Validation of groups/access
published 2026-05-05 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-29071 , GHSA-pxm6-mhxr-q4mj
- cvss
- 9.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are included in the configured allowed fields list, an unauthenticated user can self-register with admin.super privileges by injecting these fields into the registration request. This vulnerability is fixed in 2.0.0-beta.2.
Patch / fix
- packagist getgrav/grav 2.0.0-beta.2
- getgrav grav 2.0.0-beta.2
- getgrav grav_cms 2.0.0-beta.2
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 5 mo ago
Exploit prediction
1.14% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/getgrav/grav/security/advisories/GHSA-w48r-jppp-rcfw referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
| GitHub | 3.1 | 9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | getgrav/grav | <2.0.0-beta.2 |
2.0.0-beta.2 |
Affected products
- getgrav grav
Classification
References
-
github.com
/getgrav/grav-plugin-login/commit/3d419a0dabd70aed1fd49afcd5919004a4141da1
web
-
github.com
/getgrav/grav/security/advisories/GHSA-w48r-jppp-rcfw
exploit, web
-
github.com
/getgrav/grav/security/advisories/GHSA-pxm6-mhxr-q4mj
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-42613
advisory
-
github.com
/getgrav/grav
package
Sources
- CVE List CVE-2026-42613
- GitHub Advisory GHSA-pxm6-mhxr-q4mj
- NVD CVE-2026-42613
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.