CVE-2026-109317
Received Received - Intake

Privilege Escalation in Grav CMS via API Plugin

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109317
EUVD
EUVD-2026-97619

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-api 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109317 is a privilege escalation vulnerability in the Grav CMS plugin grav-plugin-api affecting versions 1.0.0 through 1.0.35. It allows delegated user managers with api.users.write permissions to gain super-admin access by exploiting scalar API access grants. The flaw occurs due to inconsistent permission validation where super-admin checks fail to reject inherited scalar parent grants, enabling unauthorized access to super-only API endpoints.

Detection Guidance

Check Grav CMS plugin versions for grav-plugin-api between 1.0.0 and 1.0.35. Review account access maps and invitations for scalar admin or API grants. Look for unauthorized access to super-only API endpoints by delegated user managers with api.users.write permissions.

Impact Analysis

If exploited, this vulnerability could allow attackers with limited permissions to escalate their privileges to super-admin level. This could lead to unauthorized access to sensitive data, system configuration changes, or control over the entire Grav CMS installation. The impact includes potential data breaches, system compromise, and loss of administrative control.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection), HIPAA (health information), or other regulations. Organizations using affected Grav versions may face legal penalties, reputational damage, and loss of certification if data breaches occur due to this flaw.

Mitigation Strategies

Update grav-plugin-api to version 1.0.36 or later. Remove any scalar admin or API grants from account access maps and invitations. Restrict api.users.write permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109317. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart