Skip to main content

grav-plugin-api CVE-2026-86193

| EUVDEUVD-2026-71995 HIGH
Incorrect Authorization (CWE-863)
2026-09-05 VulnCheck GHSA-6rq7-cjmj-rc58
Grav Plugin Api Privilege Escalation
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

Requires authenticated low-privilege API user (PR:L); no availability impact from the direct password-PATCH action; scope unchanged as attack stays within the CMS.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Sep 05, 2026 - 14:16 EUVD
Metadata Corrected
Sep 05, 2026 - 13:40 vuln.today
tag: Authentication Bypass replaced by Privilege Escalation
Analysis Generated
Sep 05, 2026 - 12:48 vuln.today
CVE Published
Sep 05, 2026 - 12:09 cve.org
HIGH 8.7

DescriptionCVE.org

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.

AnalysisAI

Privilege escalation in grav-plugin-api before 1.0.20 allows authenticated API users holding api.access and api.users.write permissions to overwrite the password of super-admin accounts whose elevated status is inherited through group membership rather than direct assignment. The user-management guard fails to evaluate group-inherited super status, treating those accounts as unprotected targets. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid API caller authenticated with both api.access and api.users.write permissions assigned - these are lower-privilege roles used for delegated user management, not super-admin roles. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) correctly characterizes this as low-complexity network exploitation requiring only low-privilege API credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade grav-plugin-api to version 1.0.20 or later, which corrects the group-inherited super permission validation in user-management guards. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: identify all Grav CMS deployments running grav-plugin-api, enumerate users holding api.access and api.users.write permissions, and immediately revoke these permissions for all non-essential accounts. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Grav Plugin Api

View all
CVE-2026-62668 CRITICAL
9.4 Aug 19

Server-Side Request Forgery in the Grav API plugin (grav-plugin-api) for Grav CMS before 1.0.6 lets a caller holding the
CVE-2026-62666 HIGH
8.8 Aug 19

Privilege escalation in Grav API Plugin (all versions before 1.0.6) allows any authenticated user holding the api.users.
CVE-2026-86196 HIGH POC
8.7 Sep 05

Host header injection in the Grav API plugin's forgot-password endpoint allows unauthenticated remote attackers to redir
CVE-2026-86195 HIGH
8.7 Sep 05

Privilege escalation in grav-plugin-api before 1.0.20 allows a low-privileged API manager to self-create a super-admin a
CVE-2026-63407 HIGH
8.2 Aug 19

Permissive CORS misconfiguration in the Grav API Plugin (all versions prior to 1.0.0-rc.16) allows cross-origin JavaScri
CVE-2026-62667 HIGH
8.1 Aug 19

Scope enforcement is entirely absent in the Grav API Plugin prior to 1.0.6, meaning any scoped API key silently exercise
CVE-2026-63408 HIGH
7.5 Aug 19

JWT bearer token leakage in the Grav API Plugin for Grav CMS (prior to 1.0.0-rc.16) exposes valid access tokens to any p
CVE-2026-11982 MEDIUM
5.1 Jun 18

Stored XSS in Grav CMS's grav-plugin-api (Admin2) allows a low-privileged editor to persist malicious JavaScript in page
CVE-2026-61607 MEDIUM
4.6 Aug 19

Stored cross-site scripting in the Grav API Plugin (all versions prior to 1.0.2) allows an authenticated attacker holdin

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2026-86193 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy