-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability allows a user with user creation privileges to take over an administrator's account by creating a new user with the same username. This is a classic privilege escalation vulnerability caused by a missing uniqueness check.
The analysis of the patch commit 3462d94d575064601689b236508c316242e15741 clearly shows the remediation strategy. The developers targeted the functions responsible for persisting user data and added checks to ensure a username does not already exist before creating a new user account.
Two primary functions were identified as vulnerable:
Grav\Common\Flex\Types\Users\UserObject::save(): This is part of Grav's modern 'Flex Objects' framework. The patch adds a call to $storage->hasKey() to verify username uniqueness.
Grav\Common\User\DataUser\User::save(): This is part of Grav's legacy user system. The patch adds a call to $locator->findResource() to check if a user file with that name already exists.
When the vulnerability is exploited, the user creation process in the Grav Admin panel will ultimately invoke one of these save() methods. In a vulnerable version, the method would proceed to overwrite the existing admin's user file. In a patched version, the added check will trigger an exception, preventing the account takeover. Therefore, these two functions are the precise runtime indicators for this vulnerability.
Grav\Common\Flex\Types\Users\UserObject::savesystem/src/Grav/Common/Flex/Types/Users/UserObject.php
Grav\Common\User\DataUser\User::savesystem/src/Grav/Common/User/DataUser/User.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getgrav/grav | composer | < 1.8.0-beta.27 | 1.8.0-beta.27 |
Ongoing coverage of React2Shell