Grav API Plugin CVE-2026-109317

Exploitation requires the attacker to already possess the 'api.users.write' capability as a delegated user manager in the Grav API plugin (versions before 1.0.36) - i.e., an authenticated, partially-privileged account, not an anonymous one. The concrete vector is editing account access maps or user invitations to store a positive scalar value on an 'admin' or 'api' parent grant, which the inheriting permission resolver then treats as satisfying requireSuper. Limiting factors: the deployment must delegate user-management rights to accounts below super-admin for this to represent a real escalation (PR:H); installations where only the super-admin holds api.users.write gain little new capability. No user interaction, no special client, and no non-default network configuration is needed beyond the API being enabled and reachable.

This is a genuine, well-scoped privilege-escalation flaw (CWE-269) rather than a hollow high-CVSS item, but its real-world urgency is tempered by a meaningful precondition. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) scoring 8.6 is internally consistent with the description: a network-reachable API, no user interaction, full confidentiality/integrity/availability impact once super-admin is obtained, but PR:H because the attacker must already hold the delegated 'api.users.write' manager capability. This is not an unauthenticated internet-facing RCE - it is a trusted-insider or compromised-delegated-account escalation from manager to super-admin. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or widespread exploitation; the signals are not conflicting, they are simply absent, which points toward this being a latent authorization-logic bug rather than an actively weaponized one. Priority should therefore be high for any deployment that delegates user-management duties to non-trusted or semi-trusted operators (multi-tenant or customer-managed Grav instances), and moderate for single-admin installations where no one below super-admin holds api.users.write.

A delegated user manager holding 'api.users.write' (for example, a customer support operator on a multi-tenant Grav site) edits an account access map or a pending invitation to insert a positive scalar admin/api parent grant. When the inheriting permission resolver evaluates these grants it satisfies the requireSuper check, so the manager's own account - or an account they control - now passes authorization for super-only API endpoints, yielding full administrative control. No public exploit code is identified at time of analysis, and because it is network-reachable via the API with no user interaction, exploitation is straightforward for anyone already granted the manager capability.