CVE-2026-86193

Name of the Vulnerable Software and Affected Versions grav-plugin-api versions prior to 1.0.20

Description The software fails to validate group-inherited super permissions within user-management guards. This allows users with manager privileges, who are not super-users, to modify super-admin accounts. An attacker possessing api.access and api.users.write permissions can patch password fields on group-super accounts to obtain full administrative control.

Recommendations Update grav-plugin-api to version 1.0.20 or later.