CVE-2026-42843

grav-plugin-api: Grav API Privilege Escalation to Super Admin

State: Published
Severity: 8.8 High
Published: May 11, 2026
Updated: May 11, 2026
Reserved: Apr 30, 2026

Description

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
grav-plugin-apigetgrav	< 1.0.0-beta.15Affected

References

https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.