8.8

CVE-2026-42843

Exploit

grav-plugin-api: Grav API Privilege Escalation to Super Admin

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta1
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta10
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta11
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta12
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta13
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta14
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta2
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta3
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta4
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta5
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta6
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta7
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta8
Getgrav ≫ Grav-plugin-api Version1.0.0 Updatebeta9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.35% 0.267
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736
Vendor Advisory
Exploit