Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 10:54:48 +0000 fkie_cve-2026-75837 https://vulnerability.circl.lu/vuln/fkie_cve-2026-75837 <p>Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.</p> <p>Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-75837 Withdrawn: GHSA-m97h-2qj3-5773 — Duplicate Advisory: Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to… https://vulnerability.circl.lu/vuln/ghsa-m97h-2qj3-5773 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xhfv-7758-r9hx. This link is maintained to preserve external references.</p> <p>### Original Description Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xhfv-7758-r9hx. This link is maintained to preserve external references.</p> <p>### Original Description Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.</p> https://vulnerability.circl.lu/vuln/ghsa-m97h-2qj3-5773