Grav API Plugin CVE-2026-62233

Exploitation requires an authenticated Grav account holding the api.users.write manager permission on an instance running grav-plugin-api before 1.0.6 with the API plugin enabled and network-reachable; the attacker then invokes the createApiKey, generate2fa, or disable2fa endpoints against a super-admin target. It does NOT require super-admin rights, user interaction, or any non-default plugin configuration, which is precisely the flaw. Limiting factors: the attacker must first possess a valid low-privilege manager credential with api.users.write (PR:L), the API plugin must be installed and exposed, and instances that never delegate manager accounts lack a realistic internal attacker to abuse it.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.7) describes a network-reachable, low-complexity attack that requires an authenticated low-privilege account and no user interaction, with high confidentiality, integrity, and availability impact on the vulnerable system. The key mitigating signal is PR:L: this is not an unauthenticated internet-wide risk but an insider or compromised-manager-credential escalation path, so real-world urgency scales with how many semi-trusted API users an instance provisions. No EPSS score, KEV listing, or POC was provided; absence of KEV means no confirmed active exploitation, and absence of EPSS leaves probabilistic exploitation likelihood unknown. Because a clean vendor patch (1.0.6) exists and the pre-conditions are modest for anyone already holding a manager token, this should be treated as a high-priority patch for multi-user Grav installations, while acknowledging the exploitation-likelihood data is incomplete.

An attacker who has obtained a non-super manager account carrying the api.users.write permission (via insider access, phishing, or credential reuse) sends an authenticated API request to createApiKey specifying a super-admin account and receives a key granting full super-admin control. Alternatively they call disable2fa against a super-admin to strip that user's second factor and ease account takeover. No public exploit code was identified, but the low attack complexity and simple REST calls make weaponization straightforward for anyone with a manager token.