CVE-2026-109317 in grav-plugin-api Plugin
Summary
by MITRE • 10/12/2026
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The Grav CMS plugin-api module prior to version 1.0.36 contains a critical privilege escalation vulnerability that undermines the intended separation of duties within the application's authorization framework. This flaw specifically targets users who have been granted delegated management capabilities, such as those with api.users.write permissions. Under normal operational parameters, these delegated user managers are restricted from accessing super-admin level functions or modifying core system configurations. However, due to a logical error in how parent grants and inheritance rules are evaluated during the permission resolution process, an attacker can manipulate account access maps or invitation structures to bypass these restrictions. By carefully crafting specific data payloads that store positive scalar values for admin or api parent grants, the vulnerability allows the inheriting permission resolver to incorrectly satisfy requireSuper checks. This logical flaw effectively elevates a standard delegated user's privileges to those of a super-administrator without requiring authentication against higher-level credentials.
From a technical perspective, this vulnerability stems from an insufficient validation mechanism within the plugin's access control logic. The system relies on a hierarchical model where permissions are inherited or aggregated based on parent grants. When processing these grants, the resolver fails to properly validate the scope and type of the scalar values being stored for admin or api roles. Instead of enforcing strict boundaries that prevent lower-privileged users from assigning super-admin status to themselves or others through indirect means, the logic accepts positive scalar inputs as valid indicators of high-level authority. This allows an attacker with write access to user accounts to inject these malformed grant structures into invitations or account configurations. Once processed by the permission resolver, these injected values trick the system into believing that the required super-admin conditions are met, thereby granting unrestricted access to sensitive API endpoints and administrative functions that should remain inaccessible to delegated managers.
The operational impact of this vulnerability is severe, as it leads to a complete compromise of the application's integrity and confidentiality. An attacker exploiting this flaw can gain full control over the Grav CMS instance, including the ability to modify core files, install malicious plugins, access sensitive user data, and execute arbitrary code if combined with other vulnerabilities in the broader ecosystem. This level of access allows for persistent backdoors, data exfiltration, and potential lateral movement within a networked environment where the web application resides. The vulnerability effectively nullifies the security model designed to limit the blast radius of compromised delegated accounts, turning what should be a limited-privilege account into a full administrative toolset for malicious actors.
This issue is categorized under CWE-269 Improper Privilege Management and aligns with MITRE ATT&CK technique T1078 Valid Accounts, specifically focusing on the abuse of existing permissions to escalate privileges within an application environment. The exploitation vector typically involves remote interaction via HTTP requests targeting user management endpoints, making it accessible to any authenticated user possessing the api.users.write permission set. To mitigate this risk, administrators must immediately upgrade the grav-plugin-api module to version 1.0.36 or later, where the logic for handling parent grants and super-admin checks has been corrected to enforce strict type and scope validation. Additionally, organizations should review their access control policies to ensure that delegated user managers have only the minimum necessary permissions required for their roles, adhering to the principle of least privilege. Regular auditing of account configurations and invitation logs can also help detect any attempts at manipulating these grant structures before they result in a successful compromise.