PT-2025-48555 · Unknown+1 · Grav Admin Plugin+1

Published 2025-12-01 · Updated 2025-12-01 · CVE-2025-66296

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27

Description Grav’s Admin plugin contains a flaw where the creation of new user accounts does not validate username uniqueness. This allows a user with create user permission to create an account with the same username as an existing administrator account, effectively gaining administrator access through privilege escalation. The username is not properly validated during account creation, allowing an attacker to overwrite administrator credentials with a new password and email.

Recommendations Update to Grav version 1.8.0-beta.27 or later.

Exploit

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-66296

GHSA-CJCP-QXVG-4RJM

Affected Products

Grav

Grav Admin Plugin

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66296.json · Exploit
• https://github.com/getgrav/grav/commit/3462d94d575064601689b236508c316242e15741 · Patch
• https://github.com/getgrav/grav/security/advisories/GHSA-cjcp-qxvg-4rjm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66296 · Security Note
• https://twitter.com/CVEnew/status/1995602411411374397 · Twitter Post
• https://t.me/CVEtracker/38588 · Telegram Post