Privilege Escalation in Grav CMS Plugin API

Executive Summary

CVE-2026-86195 is a privilege escalation flaw in grav-plugin-api versions before 1.0.20. The vulnerability exists in the InvitationsController's stripSuperFlags() method, which fails to remove dot-keyed super flags like api.super while only handling nested forms. A non-super user with specific permissions can create an invitation with a dot-keyed super flag that bypasses security checks. When accepted via a public endpoint, this creates a super-admin account with full site control.

Useful 0 Not Useful 0

Detection Guidance

Check grav-plugin-api version with: composer show grav-plugin-api. If version is below 1.0.20, the system is vulnerable. Review pending invitations in Grav admin panel for suspicious dot-keyed super flags like api.super.A in access payloads.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to gain full administrative access to a Grav CMS site without needing high privileges or user interaction. They can create super-admin accounts and obtain valid JWT tokens for complete site control. The exploit requires only api.access and api.users.write permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and control of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. Full administrative access may result in data breaches, unauthorized modifications, or data exfiltration, all of which are compliance violations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade grav-plugin-api to version 1.0.20 or later immediately. Review and purge all pending invitations in the Grav admin panel to remove any malicious flags. Verify no super-admin accounts were created during the vulnerability window.

Useful 0 Not Useful 0