CVE-2026-109317: Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants

Q: Who can exploit this vulnerability?

An attacker needs api.users.write permission. This includes delegated user managers who can edit account access maps or invitations.

Q: What level of access can an attacker obtain?

The flaw can allow a delegated user manager to obtain super-admin access. This enables access to API endpoints restricted to super-admin users.

Q: Which configurations are affected?

Affected deployments are those using Grav grav-plugin-api before 1.0.36 where a user with api.users.write can store positive scalar admin or api parent grants in account access maps or invitations.

Q: How can I determine whether my deployment may be exposed?

Check whether the installed grav-plugin-api version is earlier than 1.0.36, and review which users or delegated roles have api.users.write. Also inspect account access maps and invitations for positive scalar grants under admin or api parent permissions.

Published Oct 12, 2026

Updated

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.

Affected Software

1 affected component

Grav grav-plugin-api<1.0.36

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grav grav-plugin-api to a version that resolves this vulnerability.
Fixed in 1.0.36

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker needs api.users.write permission. This includes delegated user managers who can edit account access maps or invitations.

What level of access can an attacker obtain?

The flaw can allow a delegated user manager to obtain super-admin access. This enables access to API endpoints restricted to super-admin users.

Which configurations are affected?

Affected deployments are those using Grav grav-plugin-api before 1.0.36 where a user with api.users.write can store positive scalar admin or api parent grants in account access maps or invitations.

How can I determine whether my deployment may be exposed?

Check whether the installed grav-plugin-api version is earlier than 1.0.36, and review which users or delegated roles have api.users.write. Also inspect account access maps and invitations for positive scalar grants under admin or api parent permissions.

CVE-2026-109317: Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What level of access can an attacker obtain?

Which configurations are affected?

How can I determine whether my deployment may be exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What level of access can an attacker obtain?

Which configurations are affected?

How can I determine whether my deployment may be exposed?