CVE-2026-109317: Improper Privilege Management in getgrav grav-plugin-api
Description
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.
CVSS v4.0
Score 8.6high
Affected software
getgrav
grav-plugin-api
pkg:github/grav-plugin-apiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109317 is a privilege escalation vulnerability in Grav's grav-plugin-api prior to version 1.0.36. The flaw arises because delegated user managers can store positive scalar admin or API parent grants, which causes the inheriting permission resolver to satisfy requireSuper checks improperly. This allows attackers who have api.users.write permission to escalate their privileges to super-admin by editing account access maps or invitations, thereby gaining access to API endpoints restricted to super-admin users.
Potential Impact
An attacker with delegated user manager privileges and api.users.write permission can escalate their privileges to super-admin level, gaining unauthorized access to sensitive API endpoints that should be restricted. This could lead to full administrative control over the Grav instance, compromising the integrity and confidentiality of the system.
Mitigation Recommendations
A fix is available in grav-plugin-api version 1.0.36. Users should upgrade to version 1.0.36 or later to remediate this vulnerability. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T14:15:29.011Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd0c152cdf04f656b11bf3
Added to database: 10/12/2026, 16:34:29 UTC
Last enriched: 10/12/2026, 17:04:35 UTC
Last updated: 10/12/2026, 21:46:48 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.