CVE-2026-86195: grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-05 · updated 2026-09-08
Weakness: CWE-269

Description

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write permissions can create an invitation with a dot-keyed super flag in the access payload that bypasses the guard and persists to the new account. Attackers can accept the invitation through the public endpoint without real invitee interaction to create a super-admin account and immediately receive a valid JWT for full site control.

Affected products

getgrav grav-plugin-api: before 1.0.20 — fixed in 1.0.20

How to fix

Upgrade to a fixed version: getgrav grav-plugin-api 1.0.20. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-86195 or the next vulnerability affects your stack