CVE-2026-62233: grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey
grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achieve full instance takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.6 - Compensating control
Review for and invalidate any API keys that may have been minted or modified via the grav-plugin-api createApiKey endpoint for super-admin takeover, and ensure only trusted admins can use endpoints with privileges such as API key generation and 2FA management.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62233?
The severity of CVE-2026-62233 is rated high with a score of 8.8.
How do I fix CVE-2026-62233?
To fix CVE-2026-62233, upgrade the grav-plugin-api to version 1.0.6 or later.
What does CVE-2026-62233 exploit?
CVE-2026-62233 exploits a failure to validate super-admin status in certain API endpoints, allowing privilege escalation.
Who is affected by CVE-2026-62233?
Users with non-super admin privileges using grav-plugin-api versions before 1.0.6 are affected by CVE-2026-62233.
What is the impact of CVE-2026-62233?
The impact of CVE-2026-62233 allows unauthorized users to gain super-admin privileges, potentially compromising sensitive data and control.