Listen to this Post
The core Flex group blueprint system/blueprints/user/group.yaml access field lines 48-55 omits security@: admin.super.
Its sibling account blueprint carries security@ at account.yaml lines 131/138/150.
That guard was added by the CVE-2026-42613 fix.
Blueprint::dynamicSecurity() at system/src/Grav/Common/Data/Blueprint.php:644-662 uses security@.
It marks a field validate.ignore=true for non-super users.
BlueprintSchema::filterArray() at BlueprintSchema.php:263-311 then drops ignored fields.
The group access field is a permission map granted to every member of the group.
It is declared with check_authorize: false and NO security@ guard.
check_authorize has ZERO PHP enforcement.
grep -rn check_authorize across repo returns 0 PHP consumers.
Only two YAML blueprints reference it.
security@ is the sole real control.
Because group access lacks security@, dynamicSecurity never flags it.
filterArray retains it.
Validation::filterArray type: array, value_type: bool passes nested admin.super:true leaf.
The core save path FlexObject::update() runs.
Framework/Flex/FlexObject.php:683 calls $blueprint->filter($data,true,true).
Then save() persists to user://config/groups.yaml.
A delegated non-super operator holding admin.users.update can save such a group.
UserGroupObject::authorize then grants admin.super to every member.
This yields full privilege escalation to super-admin.
Impact includes scheduler/cron RCE and Twig eval.
The issue is distinct file, sink, and fix from four related advisories.
Affected versions are <= 2.0.12.
The guard never existed on group.yaml.
All 2.x are affected.
The group-edit UI is from flex-objects/admin plugin.
The fix belongs in core getgrav/grav.
Suggested fix adds security@: admin.super to group.yaml.
And/or enforce super-only strip on group ACL saves in core.
Reported by zx (Jace), GitHub @manus-use.
References include GHSA-h33v-82r9-v8pm.
DailyCVE Form:
Platform: Grav Flex
Version: <= 2.0.12
Vulnerability : Missing security@
Severity: Critical
date: Not provided
Prediction: No patch announced
(end of form)
What Undercode Say:
Analytics:
grep -rn check_authorize . git log -S 'security@' -- system/blueprints/user/group.yaml git log 2.0.12..HEAD -- system/blueprints/user/group.yaml grep -rn "typePermissions|filterPermissions" system/src/Grav/Common/Data
system/blueprints/user/group.yaml:48-55 access: type: array value_type: bool check_authorize: false
// system/src/Grav/Common/Data/Blueprint.php:644-662 // Blueprint::dynamicSecurity() // system/src/Grav/Common/Data/BlueprintSchema.php:263-311 // BlueprintSchema::filterArray() // Framework/Flex/FlexObject.php:683 $blueprint->filter($data, true, true);
POST /admin/accounts/groups/ops data[bash][admin][bash]=1
Exploit: (Educational Purposes!)
curl -X POST https://target/admin/accounts/groups/ops \ -d 'data[bash][admin][bash]=1'
user/config/groups.yaml gains ops: access: admin: super: true
// .../UserGroups/UserGroupObject.php:75
UserGroupObject::authorize('admin.super')
Protection: from this CVE
system/blueprints/user/group.yaml security@: admin.super
// core enforcement // super-only strip on group ACL saves
Impact:
Full privilege escalation to super-admin.
Admin panel, scheduler/cron RCE, Twig eval.
C:H/I:H/A:H.
Arbitrary group ACL rewrite.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
