CVE-2025-66296 is a high-severity (CVSS 8.8) CWE-266 vulnerability in getgrav/grav. A fix is available for getgrav/grav — see the affected versions and patch details below.
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for CVE-2025-66296.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
getgrav/gravReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator. This effectively allows privilege escalation from limited user-manager permissions to full administrator access.
Steps to Reproduce
- Make sure you have two accounts: an admin and a user with create user privilege
- In the user account, navigate to /grav-admin/admin/accounts/users and click "Add"
- Enter the name of the admin, complete registration and observe that the existing admin’s email is changed to the value you provided.
- Log out from user account log in as admin with new credentials
Impact
- Full admin takeover by any user with create user permission.
- Ability to change admin credentials, install/remove plugins, read or modify site data, and execute any action available to an admin.
- Severity: High/Critical.
PoC
https://github.com/user-attachments/assets/3ab0a7d6-5055-41be-9e0e-2bd6ca359b37
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | getgrav/grav | all versions | 1.8.0-beta.27composer require getgrav/grav:^1.8.0-beta.27 |
Affected Products
gravgetgravDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for getgrav/grav, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update getgrav/grav to 1.8.0-beta.27 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-66296 is resolved across your whole dependency graph.
Workarounds
Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.
Frequently Asked Questions
Is CVE-2025-66296 in your dependencies?
Find it across Packagist, including transitive dependencies.