CVE-2026-62233

Name of the Vulnerable Software and Affected Versions grav-plugin-api versions prior to 1.0.6

Description The software fails to validate super-admin status across the 'createApiKey', 'generate2fa', and 'disable2fa' endpoints. This allows users with api.users.write permissions who are not super-admins to escalate their privileges to super-admin status. An attacker can exploit this to create API keys linked to super-admin accounts or remove two-factor authentication (2FA) from super-admin users, leading to a complete instance takeover.

Recommendations Update grav-plugin-api to version 1.0.6 or later.