CVE-2026-86193: Grav API Plugin Authentication Bypass via Group-Inherited Super
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.20 - Compensating control
Restrict access so that only trusted admins/accounts can use api.access and api.users.write permissions, since those permissions allow patching password fields on group-super accounts for full administrative control.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker needs both the api.access and api.users.write permissions. The issue affects non-super user managers that can use the API to modify user accounts.
Which accounts are at risk of takeover?
Super-admin accounts whose super permission is inherited through a group are affected. An attacker can patch password fields on those accounts and then use the changed password to obtain full administrative control.
Are installations running the fixed release affected?
No. The issue is reported in grav-plugin-api versions before 1.0.20.