Grav CMS versions before 2.0.14 contain a critical vulnerability where the core group blueprint's access field lacks proper admin.super guard. This allows a delegated admin.users operator to escalate privileges to super-admin by setting access[admin][super]=true, thereby gaining high-level capabilities such as scheduler and Twig evaluation.