8.8

CVE-2026-42843

Exploit

grav-plugin-api: Grav API Privilege Escalation to Super Admin

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta1
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta10
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta11
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta12
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta13
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta14
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta2
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta3
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta4
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta5
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta6
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta7
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta8
Getgrav ≫ Grav-plugin-api Version 1.0.0 Update beta9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.35% 0.267
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736
Vendor Advisory
Exploit