CVE-2026-86193
Received Received - Intake

Grav Plugin API Super-Admin Privilege Escalation

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: VulnCheck

Description
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86193
EUVD
EUVD-2026-71995

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
getgrav grav-plugin-api to 1.0.20 (exc)
getgrav grav-plugin-login to 1.0.20 (exc)
getgrav grav-plugin-admin to 1.0.20 (exc)
grav plugin_api to 1.0.20 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Grav CMS plugins allows lower-privilege user managers to take over super-admin accounts through group inheritance. Security guards only check the target account's own permissions and ignore group-inherited super-admin privileges. A non-super user with API write permissions can modify or delete super-admin accounts, bypassing security restrictions.

Detection Guidance

To detect this vulnerability, check if you are running Grav CMS with grav-plugin-api versions before 1.0.20. Inspect installed plugins using commands like 'bin/grav plugin' or 'composer show grav-plugin-api'. Look for unauthorized modifications to super-admin accounts or unexpected API access logs.

Impact Analysis

Attackers with api.access and api.users.write permissions can patch password fields on group-super accounts to gain full administrative control. This could lead to full site compromise, including plugin installation for remote code execution, data access, or other malicious actions.

Compliance Impact

This vulnerability could lead to unauthorized administrative access, potentially compromising sensitive user data. For GDPR, it risks violating principles of data protection and user rights due to unauthorized access. For HIPAA, it may expose protected health information if the Grav CMS is used in healthcare contexts. Unauthorized administrative control could result in data breaches, non-compliance with access controls, and failure to meet regulatory requirements for data integrity and confidentiality.

Mitigation Strategies

Immediately update grav-plugin-api to version 1.0.20 or later. Review user accounts for unauthorized changes, especially super-admin accounts. Restrict API access permissions to only necessary users and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86193. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart