{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/grav-plugin-api--1.0.36/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getgrav:grav-plugin-api:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-109317"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["grav-plugin-api (\u003c 1.0.36)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","cms","web-application"],"_cs_type":"advisory","_cs_vendors":["Grav"],"content_html":"\u003cp\u003eThe Grav grav-plugin-api plugin, in versions prior to 1.0.36, contains a privilege escalation vulnerability that stems from improper validation of admin or API parent grants. Attackers who possess the 'api.users.write' permission can modify account access maps or invitations. By manipulating these structures to include positive scalar values, an attacker can coerce the permission resolver to incorrectly satisfy 'requireSuper' authorization checks. This flaw allows a standard user manager to elevate their privileges to that of a super-admin, granting them access to restricted API endpoints that should be protected. This vulnerability poses a significant risk to the integrity and confidentiality of the Grav management interface, as it allows for unauthorized administrative control over the application.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a user with existing, limited 'api.users.write' permissions to escalate their account status to a super-admin level. This provides complete control over the Grav instance's API, potentially leading to unauthorized data exfiltration, system configuration changes, or the compromise of all hosted content. Organizations using the Grav CMS with the affected plugin are vulnerable if they have delegated user management responsibilities to non-administrative accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the Grav grav-plugin-api plugin by upgrading to version 1.0.36 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing user accounts and access maps for unauthorized modification or suspicious assignment of 'admin' or 'api' parent grants.\u003c/li\u003e\n\u003cli\u003eRestrict 'api.users.write' permissions to only the most trusted administrative accounts until the upgrade is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:35:09Z","date_published":"2026-10-12T18:35:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-grav-privesc/","summary":"A privilege escalation vulnerability (CVE-2026-109317) in the Grav grav-plugin-api plugin before version 1.0.36 allows users with delegated management permissions to obtain super-admin access.","title":"Privilege Escalation in Grav grav-plugin-api","url":"https://feed.craftedsignal.io/briefs/2026-10-grav-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Grav-Plugin-Api (\u003c 1.0.36)","version":"https://jsonfeed.org/version/1.1"}