Privilege Escalation in Grav Plugin API Affects User Management
CVE-2026-109317

8.6HIGH

Key Information:

Vendor

Getgrav

Status
Grav-plugin-api
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109317?

The Grav Plugin API prior to version 1.0.36 exhibits a vulnerability that enables delegated user managers to achieve super-admin access. This is accomplished by exploiting the storage of positive scalar grants related to admin or API roles. Attackers holding the api.users.write permission can manipulate account access configurations and invitations, thus satisfying the requirement checks for super admin privileges and gaining access to restricted super-only API endpoints.

Affected Version(s)

grav-plugin-api 0 < 1.0.36

grav-plugin-api 1.0.36

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
vendor-advisorythird-party-advisory
https://www.vulncheck.com/advisories/grav-api-plugin-befo...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

redwolf1919
.