Grav API Plugin CVE-2026-62666

Exploitation requires an authenticated account on the target Grav CMS instance holding the api.users.write ACL permission - this is the specific grant that controls access to the UsersController endpoints and is the non-default condition that gates the attack. The Grav API Plugin (grav-plugin-api) must be installed and active; the vulnerability does not exist in Grav core. At least one super-admin account must exist in the system to serve as the escalation target. Network access to the API endpoints exposed by the plugin is required, which in typical deployments means HTTP(S) access to the CMS host. Exploitation is strictly limited to versions prior to 1.0.6. No further special configuration is necessary - the vulnerable endpoints are exposed by default once the plugin is active and the attacker holds api.users.write. Exploitation is limited by the need for a pre-existing authenticated account; unauthenticated exploitation is not possible per the CVSS PR:L metric.

The CVSS 8.8 score accurately reflects real-world risk: the attack is network-accessible, low complexity, requires no user interaction, and demands only a low-privilege account holding api.users.write - a permission routinely granted to editors, developers, or integration service accounts in multi-user Grav deployments. The escalation outcome is particularly severe because it produces persistent super-admin access and can strip 2FA from existing super-admin accounts, undermining the entire authentication posture of the site. No EPSS score was provided in the available data, and the CVE does not appear in CISA KEV, so confirmed active exploitation is not established; however, the patch diff is public and the attack path requires only standard REST API calls, meaning exploitation windows could compress rapidly once threat actors process the advisory. Even a mid-sized municipal IT team in rybnik running Grav for a headless public-facing site should treat this as urgent if the API plugin is deployed alongside multiple accounts holding api.users.write. The CVSS vector is consistent with the described mechanics: PR:L correctly captures the api.users.write prerequisite, and S:U is appropriate since the escalation operates within the same application security boundary rather than pivoting to a separate system.

An attacker with a low-privilege Grav account holding api.users.write authenticates to the REST API and issues a createApiKey() request targeting a known super-admin username; the missing accessGrantsSuper() check allows the request to succeed, returning a valid API key bound to the super-admin account. Because key scopes were not enforced prior to the patch, the returned key provides unrestricted super-admin privileges, which the attacker uses to create additional backdoor accounts, alter content, or call disable2fa() to strip multi-factor authentication from the original super-admin. No public proof-of-concept has been identified, but the attack path is a straightforward sequence of authenticated HTTP API calls requiring no memory corruption, deserialization, or chaining of multiple vulnerabilities.