CVE-2026-42609— Grav 安全漏洞

Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the request. This leads to a Denial of Service (DoS) on administrative functions and Privilege De-escalation of the root account. This vulnerability is fixed in 2.0.0-beta.2.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

特权管理不恰当

Grav 安全漏洞

Grav是Grav开源的一套可扩展的用于个人博客、小型内容发布平台和单页产品展示的CMS（内容管理系统）。 Grav 2.0.0-beta.2之前版本存在安全漏洞，该漏洞源于Grav管理面板中的业务逻辑漏洞，可能导致低权限用户通过创建已存在的用户名覆盖现有账户，包括主管理员，进而导致管理功能拒绝服务和根账户权限降级。

N/A

N/A