grav-plugin-api CVE-2026-86193

Exploitation requires a valid API caller authenticated with both api.access and api.users.write permissions assigned - these are lower-privilege roles used for delegated user management, not super-admin roles. The target account must hold super-admin status exclusively through group-inherited permissions (not directly assigned super role); accounts with directly-assigned super status may not be affected. The plugin version must be below 1.0.20. Deployments that have not provisioned any API accounts with api.users.write permission have no exposed attack surface. There is no path to unauthenticated exploitation, and exploitation is bounded to the Grav CMS user-account domain - it does not directly affect the underlying host OS or other services.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) correctly characterizes this as low-complexity network exploitation requiring only low-privilege API credentials. The high VC:H/VI:H rating is justified since successful exploitation yields super-admin credential takeover. The provided VA:H metric appears overstated - the direct action of the exploit is a password-field PATCH, which does not directly degrade availability; downstream availability impact would require a subsequent action by the attacker post-compromise, not the exploit itself. EPSS data is not available in the provided intelligence. No CISA KEV listing and no public POC have been identified, which moderates urgency compared to the raw score. Real-world risk is highest for Grav deployments that have provisioned delegated API user-managers (api.users.write) as a normal operational pattern - organizations without this delegation model have no directly exposed attack surface. The two-permission requirement (api.access + api.users.write) is a meaningful limiting factor but does not require administrator-level access, so the exposure should not be dismissed in multi-tenant or SaaS Grav environments.

An attacker operating a legitimate but lower-privileged API integration account (holding api.access and api.users.write) identifies a Grav administrator whose super status comes from group membership. The attacker sends a crafted PATCH request to the user-management API endpoint targeting that account's password field; the guard bypasses the super check and accepts the modification. The attacker then authenticates to Grav with the new credentials, gaining full super-admin control over the CMS. No public exploit code has been identified at time of analysis.