PT-2026-110734 · Grav · Grav-Plugin-Api
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
grav-plugin-api versions prior to 1.0.36
Description
A privilege escalation issue allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers possessing the
api.users.write permission can modify account access maps or invitations. This manipulation causes the inheriting permission resolver to satisfy requireSuper checks, enabling unauthorized access to API endpoints restricted to super-admins.Recommendations
Update grav-plugin-api to version 1.0.36 or later.
Exploit
Fix
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Grav-Plugin-Api