Vulnerability · Published May 11, 2026 · Assigned by GitHub_M

CVE-2026-42843grav-plugin-api: Grav API Privilege Escalation to Super Admin

High 8.8

In plain English

A high-severity incorrect authorization in grav-plugin-api from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 71.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	getgrav/grav-plugin-api	1.0.0-beta.15	GHSA-r945-h4vm-h736

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav-plugin-api	< 1.0.0-beta.15

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736 x_refsource_CONFIRM