Grav API Plugin CVE-2026-42843

Exploitation requires the attacker to possess valid credentials for any Grav user account that has been granted the 'api.access' permission. This permission level is commonly assigned to content editors, developers, site contributors, or other non-administrative roles in multi-user Grav deployments to enable programmatic content management via the API. The Grav API Plugin must be installed and enabled in the target installation (default route /api with version prefix v1). No specific non-default configuration settings, enabled features, or deployment modes are required beyond basic API Plugin activation and at least one user account possessing 'api.access' permission. The vulnerability is exploitable against default configurations of Grav API Plugin versions prior to 1.0.0-beta.15. Exploitation does not require the attacker to hold 'api.users.write' or administrative permissions initially - the baseline 'api.access' permission is sufficient. The attack is not limited by network topology (CVSS AV:N indicates remotely exploitable over HTTP/HTTPS), requires low attack complexity (CVSS AC:L, straightforward PATCH request), and does not depend on user interaction (CVSS UI:N). The primary limiting factor for real-world risk assessment is the authentication prerequisite (CVSS PR:L), which narrows the attack surface to scenarios involving credential compromise, insider threats, or environments where 'api.access' is broadly distributed to non-trusted user populations.

This vulnerability presents critical real-world risk despite the 8.8 CVSS score requiring low-privileged authentication (PR:L). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects network-accessible exploitation with low complexity and no user interaction required. The authentication prerequisite ('api.access' permission) is a minimal barrier in typical Grav deployments where API access is granted to content editors, developers, or other non-administrative users. The impact is vertical privilege escalation to the highest privilege tier (Super Administrator), enabling complete CMS takeover including content manipulation, configuration changes, malicious plugin uploads, and critically, Twig template editing outside sandbox constraints leading to authenticated remote code execution on the underlying server. A functional proof-of-concept with exact HTTP requests is included in the GitHub Security Advisory, significantly lowering exploitation complexity for threat actors. No EPSS or KEV data is provided in the input, preventing assessment of observed exploitation trends, but the combination of public POC, vendor-confirmed patch, and severe post-exploitation capabilities (privilege escalation to RCE chain) makes this a high-priority remediation target for any organization running affected Grav API Plugin versions. The narrow prerequisite (valid credentials with 'api.access') limits exposure compared to unauthenticated vulnerabilities but does not substantially reduce risk in multi-user or multi-tenant Grav environments.

An attacker possessing valid credentials for a low-privileged Grav user account with 'api.access' permission (such as a content editor, contractor, or compromised user) authenticates to the Grav API by sending a POST request to /api/v1/auth/token with their username and password, receiving a JWT access token in response. The attacker then crafts a PATCH request to /api/v1/users/{their_username} with the stolen or legitimate token in the X-API-Token header and a JSON body containing a malicious 'access' object: {"access":{"admin":{"login":true,"super":true},"api":{"access":true,"super":true},"site":{"login":true}}}. The vulnerable UsersController::update method validates the user is editing their own profile (requiring only 'api.access'), processes the 'access' field from the whitelist without secondary authorization checks, and persists the attacker-controlled permission structure to the user account file. Upon logging into the Grav Admin Panel with the same credentials, the attacker now holds Super Administrator privileges, enabling them to upload malicious plugins, edit Twig templates outside sandbox restrictions to inject PHP code execution payloads (e.g., <?php system($_GET['cmd']); ?> in custom templates), modify security configurations, create backdoor admin accounts, or exfiltrate sensitive data from the CMS database and configuration files.