CVE-2026-109317: Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.36
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs api.users.write permission. This includes delegated user managers who can edit account access maps or invitations.
What level of access can an attacker obtain?
The flaw can allow a delegated user manager to obtain super-admin access. This enables access to API endpoints restricted to super-admin users.
Which configurations are affected?
Affected deployments are those using Grav grav-plugin-api before 1.0.36 where a user with api.users.write can store positive scalar admin or api parent grants in account access maps or invitations.
How can I determine whether my deployment may be exposed?
Check whether the installed grav-plugin-api version is earlier than 1.0.36, and review which users or delegated roles have api.users.write. Also inspect account access maps and invitations for positive scalar grants under admin or api parent permissions.