PT-2026-86420 · Grav · Grav-Plugin-Api
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
grav-plugin-api versions prior to 1.0.20
Description
A privilege escalation issue exists in the
InvitationsController where the stripSuperFlags() function fails to remove dot-keyed equivalents such as api.super, only removing nested super flags. A user manager possessing api.access and api.users.write permissions can include a dot-keyed super flag in the access payload when creating an invitation. This bypasses the security guard and persists the flag to the new account. An attacker can then use the public endpoint to accept the invitation without the invitee's interaction, creating a super-admin account and obtaining a JSON Web Token (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—for full site control.Recommendations
Update grav-plugin-api to version 1.0.20 or later.
Exploit
Fix
LPE
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Grav-Plugin-Api