grav-plugin-api EUVD-2026-66394

Exploitation requires possession of a valid grav-plugin-api API key that belongs to a super-admin account but is scoped below full super authority, and the target Grav instance must run the plugin at a version before 1.0.18 with the API reachable by the attacker. The bug is triggered against the seven user-management endpoints guarded by requireNotSuperTarget() in UsersController.php. Limiting factors: the attacker cannot succeed with an ordinary non-super account's key (the account must itself be super-admin), so this is fundamentally a scope-escalation from an already-privileged credential rather than open unauthenticated access, which meaningfully narrows the realistic attacker set to insiders or those who have stolen such a key. No user interaction is required.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.3, but PR:N conflicts with the description, which plainly requires the attacker to already hold a valid API key belonging to a super-admin account-i.e., meaningful prior privilege. Treat this as an authenticated privilege/scope-escalation issue (PR:L in my independent assessment), not a fully unauthenticated RCE-class flaw; the network vector and low complexity are accurate, and impact is genuinely high once the precondition is met. There is no CISA KEV listing and no POC/exploit signal in the provided data, and no EPSS score was supplied, so real-world exploitation pressure appears low-to-moderate and gated by insider or credential-compromise scenarios. Bottom line: high technical impact but a real precondition (possession of a super-admin account's scoped key), so prioritize patching for any Grav install exposing this API, while recognizing it is less broadly weaponizable than the raw 9.3 implies.

An operator issues a deliberately down-scoped API key under a super-admin account for a limited automation task; an attacker who obtains that key (or a malicious insider holding it) calls the affected user-management endpoints to disable another super-admin's 2FA and mint a new API key under that victim's identity, achieving full account takeover. Because the vector is network-based with low complexity, the actions are simple authenticated HTTP requests once the key is in hand; no public POC is identified in the provided data.