Listen to this Post
The vulnerability exists in Grav’s Admin plugin due to missing username uniqueness validation during user creation. A user with ‘create user’ permissions can exploit this by specifying an existing administrator’s username when creating a new account. The system does not check for duplicates, allowing the attacker to set a new password and email for that username. This action creates a conflicting user entry in Grav’s file-based storage, typically in YAML files. Upon creation, the new credentials are associated with the administrator username, effectively overwriting or shadowing the original admin account. The attacker can then log in using the newly set password, gaining full administrative privileges. This bypasses access controls and escalates privileges from a limited user-manager role to superuser. The issue stems from the user creation function lacking a check against existing usernames in the user data files. In file-based systems, user accounts are stored as individual files, and without validation, duplicate filenames or entries can be written. The attack can be performed via the web interface or any exposed API endpoint that handles user creation. The vulnerability is critical as it requires only basic user creation permissions and leads to complete system compromise. The fix in version 1.8.0-beta.27 adds a validation step to ensure username uniqueness before creating a new user.
Platform: Grav
Version: Before 1.8.0-beta.27
Vulnerability: Privilege Escalation
Severity: Critical
Date: 12/01/2025
Prediction: Patched in 1.8.0-beta.27
What Undercode Say:
Analytics
List user account YAML files in Grav
find /var/www/grav -name ".yaml" -path "/accounts/" -type f
Check for duplicate usernames in account files
grep -h "username:" /path/to/grav/user/accounts/.yaml | cut -d: -f2 | sort | uniq -d
Simulated vulnerable code snippet
function createUser($username, $pass) {
$file = "accounts/{$username}.yaml";
// No check for existing username
file_put_contents($file, "username: {$username}\npassword: " . hash($pass));
}
how Exploit:
- Acquire create user permission.
- Duplicate admin username via creation form.
- Set new password and email.
- Login with new admin credentials.
Protection from this CVE
- Update to 1.8.0-beta.27.
- Add uniqueness validation.
- Limit user creation permissions.
Impact:
- Full admin access.
- Privilege escalation.
- System compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
