Grav Admin Privilege Escalation via Group Blueprint Access

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Grav CMS before version 2.0.14 contains a critical privilege escalation vulnerability where the core group blueprint fails to enforce proper role-based access controls. Specifically, the access field lacks the required security@: admin.super restriction, allowing delegated admin.users operators to manipulate group configurations and inject admin.super=true values. This flaw is particularly dangerous because it enables lower-privileged administrators to escalate their own permissions to super-admin status, gaining unrestricted access to dangerous capabilities like task scheduling and server-side Twig template evaluation. Organizations running vulnerable Grav instances are at immediate risk, especially those with multiple administrative users or delegated access models.

Casky's 224 matched security skills leverage Claude AI's extended reasoning to detect this attack pattern by correlating behavioral indicators across TA0004 (Privilege Escalation) techniques. Practitioners using the platform would observe detection signals including: unauthorized modification of role/permission fields in group configuration objects, suspicious changes to access control metadata that deviate from baseline admin activity, and post-exploitation indicators such as new scheduled tasks or Twig template execution attempts following privilege modifications. The AI-driven analysis maps these observations to CWE-269 (Improper Access Control) patterns and identifies the attack chain—specifically, the transition from user-level admin credentials to super-admin capabilities through blueprint manipulation—giving security teams the context needed to investigate and remediate before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75837.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-75837

Casky has 224 skills that investigate the attack patterns behind CVE-2026-75837. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn