CVE-2026-86195 in grav-plugin-api
Summary
by MITRE • 09/05/2026
grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write permissions can create an invitation with a dot-keyed super flag in the access payload that bypasses the guard and persists to the new account. Attackers can accept the invitation through the public endpoint without real invitee interaction to create a super-admin account and immediately receive a valid JWT for full site control.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in Grav Plugin API versions prior to 1.0.20 represents a critical privilege escalation flaw rooted in improper access control enforcement within the InvitationsController. The core technical deficiency lies in the stripSuperFlags() method, which is designed to sanitize user permissions by removing super-administrator flags before persisting new accounts or processing invitations. However, this sanitization logic is incomplete because it only targets nested array structures for super flags while failing to inspect and remove dot-keyed equivalents such as api.super. This oversight creates a bypass mechanism where the security guard intended to prevent non-privileged users from assigning administrative rights can be circumvented through specific payload formatting that exploits the parser's inability to recognize alternative key representations of the same permission level.
A user with standard manager privileges, specifically possessing only api.access and api.users.write permissions, is able to exploit this flaw by crafting an invitation request where the access payload includes a dot-keyed super flag rather than the expected nested structure. Because the stripSuperFlags() method does not account for these alternative key formats, it allows the elevated permission to pass through validation checks unchanged. When the invitation is processed and persisted to the database, the new user account inherits full super-administrator privileges despite being created by a lower-privileged entity. This effectively breaks the principle of least privilege and allows unauthorized elevation of access rights within the application's authentication framework.
The operational impact of this vulnerability is severe due to the ease with which it can be exploited without requiring interaction from the intended recipient of the invitation. Attackers can accept the generated invitation through public-facing endpoints, thereby creating a new super-admin account on the target system. Upon successful acceptance and account creation, the attacker immediately receives a valid JSON Web Token associated with full site control capabilities. This grants unrestricted access to all administrative functions, data stores, and configuration settings, potentially leading to complete compromise of the underlying web application environment, including potential further lateral movement or data exfiltration depending on the broader system architecture.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as it involves an actor obtaining privileges that they are not authorized to possess due to flawed enforcement logic. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, specifically the sub-technique of using legitimate credentials obtained through privilege escalation or account creation abuse. The attack vector leverages valid but insufficiently restricted API endpoints to establish persistent administrative access without detection by standard permission checks.
Mitigation for this vulnerability requires an immediate update to Grav Plugin API version 1.0.20 or later, where the stripSuperFlags() method has been corrected to handle both nested and dot-keyed super flag representations uniformly. In environments where patching is not immediately feasible, administrators should implement strict input validation on all invitation creation endpoints to reject any access payloads containing unauthorized permission keys regardless of their structural format. Additionally, enforcing role-based access control checks at the database level rather than solely relying on application-layer sanitization can provide defense-in-depth against such privilege escalation attempts. Regular auditing of user permissions and monitoring for unusual account creation patterns involving elevated privileges should also be employed to detect potential exploitation activities in real-time.