Grav API Plugin EUVD-2026-58643

Exploitation requires the attacker to possess a valid api.users.write-scoped API key that was specifically minted on (i.e., associated with) a super-admin Grav account - a key of the same scope issued on a non-super account cannot trigger the bypass because isSuperAdmin() on that parent returns false. The Grav API plugin must be installed and enabled on the target instance. Network access to the Grav API endpoint is required. What limits exploitation: the prerequisite of already holding a legitimate API key with api.users.write scope on a super account is a meaningful barrier - unauthenticated attackers and those with keys on non-super accounts cannot exploit this flaw. The vulnerability does not affect Grav installations where the API plugin is absent, disabled, or where no api.users.write keys have been issued against super accounts.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity flaw requiring only low-privilege API credentials, with high impact across confidentiality, integrity, and availability - consistent with the ability to mint uncapped super accounts. The EPSS score (0.30%, 23rd percentile) suggests automated mass exploitation has not yet materialized, but this signal conflicts with SSVC's Automatable:Yes and Technical Impact:Total ratings, indicating that once a proof-of-concept is operationalized, wide-scale automated abuse is feasible. Active exploitation is not confirmed - no CISA KEV listing exists at time of analysis - and EPSS may underrepresent targeted exploitation. The low EPSS should not be interpreted as low priority: any deployment running the API plugin with super-admin-issued api.users.write keys is at immediate risk of account takeover, and the automatable rating means exploitation tooling could rapidly scale. This is a genuine patch priority for any affected installation.

An attacker possessing a valid api.users.write-scoped API key issued on a super-admin Grav account sends a crafted POST request to the UsersController create() or update() endpoint, supplying a payload that sets access.api.super on a target account or adds it to a super-granting group. Because isSuperAdmin() resolves against the parent account rather than the key's scope, the check passes and the privilege assignment succeeds; the attacker then authenticates as the newly promoted account and gains unrestricted super-administrator access. A proof-of-concept exists per SSVC, and the network-accessible API with no user interaction requirement makes this attack straightforward to automate.