CVE-2026-86195: grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag
grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write permissions can create an invitation with a dot-keyed super flag in the access payload that bypasses the guard and persists to the new account. Attackers can accept the invitation through the public endpoint without real invitee interaction to create a super-admin account and immediately receive a valid JWT for full site control.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.20
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments running grav-plugin-api versions 1.0.0 through 1.0.19 are affected. Version 1.0.20 is not described as affected.
What access does an attacker need to exploit this?
The attacker needs a non-super user-manager account with both api.access and api.users.write permissions. They can then create an invitation whose access payload includes a dot-keyed api.super flag.
Does exploitation require the invited person to take action?
No. The attacker can accept the invitation through the public endpoint without interaction from a real invitee, creating a super-admin account and receiving a valid JWT immediately.