This vulnerability arises from a business logic flaw in Grav's Admin Panel before version 2.0.0-beta.2. Specifically, when a user with limited privileges attempts to create a new user with a username that already exists, the system incorrectly updates the existing account's metadata and permissions instead of rejecting the request. This enables the attacker to overwrite accounts, including the primary administrator, causing denial of service and privilege de-escalation. The CVSS 3.1 score is 8.1 (high severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. The issue is resolved in version 2.0.0-beta.2.

Exploitation allows a low-privileged user to overwrite existing user accounts, including the primary administrator, resulting in denial of service on administrative functions and privilege de-escalation. This compromises the integrity and availability of the Grav platform's administrative capabilities. There is no direct confidentiality impact reported.

Upgrade Grav to version 2.0.0-beta.2 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Patch status is not explicitly stated beyond the fixed version; therefore, users should verify with the vendor advisory for the latest remediation guidance.