CVE-2026-86195: Improper Privilege Management in getgrav grav-plugin-api

The vulnerability in grav-plugin-api (versions <1.0.20) arises from improper privilege management in the InvitationsController. Specifically, the stripSuperFlags() method fails to remove dot-keyed super flags such as 'api.super' from the access payload. Consequently, a non-super user manager possessing 'api.access' and 'api.users.write' permissions can craft an invitation embedding a dot-keyed super flag that bypasses the intended guard. When the invitation is accepted via the public endpoint, the attacker can create a super-admin account and immediately obtain a valid JWT token, granting full administrative control over the site.

An attacker with limited API permissions can escalate privileges to super-admin by exploiting the failure to strip dot-keyed super flags in invitations. This leads to full site compromise, including unauthorized administrative access and control. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API permissions to trusted users only and monitor for suspicious invitation creation activities. Avoid accepting invitations from untrusted sources.