All vulnerabilities
CVE-2026-109317GHSA-m2rq-76vx-vv4j

grav-plugin-api: Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants

getgrav grav-plugin-api
Open in ThreatlineRecord JSON
CVSS
8.6High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.0.36Fixed versionCVE List
Published12 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.

Text from CVE List

Affected versions 2

  • grav-plugin-apiaffected: all versions before 1.0.36CVE List
  • grav-plugin-apiunaffected: 1.0.36CVE List

References 2