https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T15:47:59.380115+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-75837 CVE-2026-75837 — Grav before 2.0.14 Privilege Escalation via Group Access Field 2026-10-09T15:47:59.397555+00:00

Affected: getgrav grav

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.