CVE-2026-62233
Received Received - Intake

Grav Plugin API Privilege Escalation via Missing Super-Admin Validation

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: VulnCheck

Description
grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achieve full instance takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-17
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2026-62233
EUVD
EUVD-2026-45121

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
grav plugin_api to 1.0.6 (exc)
getgrav grav-plugin-api to 1.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62233 is a privilege escalation vulnerability in the grav-plugin-api component of Grav CMS. It affects versions before 1.0.6 and exists in the createApiKey, generate2fa, and disable2fa endpoints. These endpoints fail to validate super-admin status, allowing non-super users with api.users.write permission to escalate privileges to super-admin level. Attackers can create API keys bound to super-admin accounts or remove two-factor authentication from super-admin users, leading to full instance takeover.

Detection Guidance

Check Grav plugin-api version with: composer show grav/plugin-api. Inspect API logs for unauthorized createApiKey, generate2fa, or disable2fa requests targeting super-admin accounts. Review user roles for non-super users with api.users.write permission.

Impact Analysis

If you use Grav CMS with grav-plugin-api versions before 1.0.6, attackers with non-super user roles but api.users.write permission could exploit this to gain super-admin access. This could result in complete control over your Grav instance, unauthorized data access, or system modifications. The impact includes potential data breaches, loss of confidentiality, integrity, and availability of your Grav CMS environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). A successful exploit may result in data breaches, unauthorized disclosure, or modification of protected data, potentially leading to legal penalties, fines, or reputational damage for organizations subject to these regulations.

Mitigation Strategies

Upgrade grav-plugin-api to version 1.0.6 or later immediately. Remove api.users.write permission from non-super users. Monitor API endpoints for suspicious activity targeting super-admin accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62233. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart