PT-2026-86418

CVE-2026-86193

Published

2026-09-05

Updated

2026-09-05

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions grav-plugin-api versions prior to 1.0.20

Description The software fails to validate group-inherited super permissions within user-management guards. This allows users with manager privileges, who are not super-users, to modify super-admin accounts. An attacker possessing api.access and api.users.write permissions can patch password fields on group-super accounts to obtain full administrative control.

Recommendations Update grav-plugin-api to version 1.0.20 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

1K0Ct

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

Related identifiers