CVE-2026-86193 in Grav Plugin
Summary
by MITRE • 09/05/2026
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/05/2026
The Grav Plugin API prior to version 1.0.20 contains a critical authorization flaw within its user management guards that stems from an insufficient validation of permissions inherited through group memberships. This vulnerability specifically affects the logic used to determine whether a requesting user has sufficient privileges to modify specific administrative accounts, particularly those designated as super-administrators. The core technical issue lies in the failure of the application to correctly distinguish between direct user-level permissions and those derived from broader group associations when evaluating access control lists for sensitive operations. Consequently, users who possess standard API access rights are incorrectly granted elevated capabilities that should be strictly reserved for individuals with explicit super-user status.
This flaw allows attackers possessing only basic api.access and api.users.write privileges to bypass intended security boundaries. By exploiting the misconfigured permission checks, an attacker can target user accounts configured as group-super or full administrative entities. The attack vector involves crafting a specific API request that patches critical fields on these high-privilege accounts, most notably the password field. Because the system fails to validate whether the requester holds super-admin status before allowing modifications to such accounts, the authentication credentials of an administrator can be overwritten without triggering appropriate security alerts or access denials. This effectively grants the attacker full administrative control over the Grav instance, as they can log in with the newly set credentials and perform any action available to a system owner.
The operational impact of this vulnerability is severe, leading to complete compromise of the web application's integrity and confidentiality. Once an attacker gains super-admin access through credential manipulation, they can install malicious plugins, modify core configuration files, exfiltrate sensitive data stored within the CMS, or create backdoor accounts for persistent access. This represents a classic case of broken access control where privilege escalation occurs not through code execution but through logical errors in permission evaluation. The vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, as the system fails to enforce proper role-based restrictions on administrative functions. Furthermore, this behavior is consistent with ATT&CK technique T1078 Valid Accounts, specifically the sub-category of Local Accounts being used for initial access or persistence after exploitation.
To mitigate this risk, administrators must immediately upgrade the Grav Plugin API to version 1.0.20 or later, where these permission checks have been corrected to properly validate group-inherited super permissions before allowing modifications to administrative accounts. In addition to updating software, it is advisable to implement strict role-based access control policies that limit api.users.write privileges only to users who explicitly require them for legitimate operational tasks. Regular auditing of user roles and API key permissions can help detect any unauthorized assignments early. Security teams should also monitor logs for unusual patterns in password reset requests or administrative account modifications originating from non-administrative sources, as these may indicate attempted exploitation of this vulnerability before the patch is applied.