What’s Vulnerable › Vulnerabilities

CVE-2026-42843: grav-plugin-api: Grav API Privilege Escalation to Super Admin

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-11 · updated 2026-10-26
• Weakness: CWE-863

Description

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.

Affected products

• getgrav grav-plugin-api: 1.0.0-beta1, 1.0.0-beta10, 1.0.0-beta11, 1.0.0-beta12, 1.0.0-beta13, 1.0.0-beta14 (+8)

References

• https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736
• https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736

Get alerted when CVE-2026-42843 or the next vulnerability affects your stack