CVE-2026-109317
Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
- State
- Published
- Severity
- 8.6 High
- Published
- Oct 12, 2026
- Updated
- Oct 15, 2026
- Reserved
- Oct 12, 2026
Description
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
grav-plugin-apigetgrav |
|
References
- GitHub Security Advisory (GHSA-m2rq-76vx-vv4j)vendor-advisorythird-party-advisory
- VulnCheck Advisory: Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grantsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.