CVE-2026-42609

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-42609

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42609.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-42609

Aliases

GHSA-rr73-568v-28f8

Published

2026-05-11T15:03:38Z

Modified

2026-10-28T02:31:01Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

Details

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the request. This leads to a Denial of Service (DoS) on administrative functions and Privilege De-escalation of the root account. This vulnerability is fixed in 2.0.0-beta.2.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-269",
        "CWE-285",
        "CWE-639",
        "CWE-837"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42609.json"
}

References

Affected packages

Git / github.com/getgrav/grav

Affected ranges

Type

GIT

Repo

https://github.com/getgrav/grav

Events

Introduced

Fixed

3077b04b220318883ed34b6ae2a6cd0f25dba92e

Fixed

5a12f9be8314682c8713e569e330f11805d0a663

Fixed

c66dfeb5ff679a1667678c6335eb9ff3255dfc47

Fixed

d904efc33e03ebb597afde8d3368b28cf0423632

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.0.0-beta.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "5a12f9be8314682c8713e569e330f11805d0a663"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "c66dfeb5ff679a1667678c6335eb9ff3255dfc47"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "d904efc33e03ebb597afde8d3368b28cf0423632"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*

0.8.0

0.9.0

0.9.10

0.9.11

0.9.12

0.9.13

0.9.14

0.9.15

0.9.16

0.9.17

0.9.18

0.9.19

0.9.2

0.9.3

0.9.4

0.9.5

0.9.6

0.9.7

0.9.8

0.9.9

1.*

1.1.0-beta.1

1.1.0-beta.2

1.1.0-beta.3

1.1.0-beta.4

1.1.0-beta.5

1.1.0-rc.1

1.1.0-rc.2

1.1.0-rc.3

1.1.9-rc.1

1.1.9-rc.2

1.1.9-rc.3

1.2.0-rc.1

1.2.0-rc.2

1.2.0-rc.3

1.3.0-rc.1

1.3.0-rc.3

1.3.0-rc.4

1.3.0-rc.5

1.5.0-beta.1

1.5.0-beta.2

1.5.0-rc.1

1.6.0-beta.1

1.6.0-beta.2

1.6.0-beta.5

1.6.0-beta.6

1.6.0-beta.7

1.6.0-beta.8

1.6.0-rc.1

1.6.0-rc.2

1.6.0-rc.3

1.6.0-rc.4

1.7.0-beta.1

1.7.0-beta.10

1.7.0-beta.2

1.7.0-beta.3

1.7.0-beta.4

1.7.0-beta.5

1.7.0-beta.6

1.7.0-beta.7

1.7.0-beta.8

1.7.0-beta.9

1.7.0-rc.1

1.7.0-rc.10

1.7.0-rc.12

1.7.0-rc.13

1.7.0-rc.14

1.7.0-rc.15

1.7.0-rc.17

1.7.0-rc.18

1.7.0-rc.19

1.7.0-rc.2

1.7.0-rc.20

1.7.0-rc.3

1.7.0-rc.4

1.7.0-rc.5

1.7.0-rc.6

1.7.0-rc.7

1.7.0-rc.8

1.7.0-rc.9

1.8.0-beta.1

1.8.0-beta.10

1.8.0-beta.11

1.8.0-beta.12

1.8.0-beta.13

1.8.0-beta.14

1.8.0-beta.15

1.8.0-beta.16

1.8.0-beta.17

1.8.0-beta.18

1.8.0-beta.19

1.8.0-beta.2

1.8.0-beta.20

1.8.0-beta.21

1.8.0-beta.22

1.8.0-beta.23

1.8.0-beta.24

1.8.0-beta.25

1.8.0-beta.26

1.8.0-beta.27

1.8.0-beta.28

1.8.0-beta.29

1.8.0-beta.3

1.8.0-beta.4

1.8.0-beta.5

1.8.0-beta.6

1.8.0-beta.7

1.8.0-beta.8

1.8.0-beta.9

2.*

2.0.0-beta.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42609.json"