Skip to content
Threat Feed
Subscribe

Product

Grav-Plugin-Api

1 brief RSS
high advisory

Grav Plugin API Privilege Escalation via Authorization Bypass (CVE-2026-62233)

A privilege escalation vulnerability (CVE-2026-62233) in grav-plugin-api before version 1.0.6 allows non-super api.users.write managers to bypass authorization checks on administrative API endpoints, enabling the creation of super-admin API keys or disabling super-admin Two-Factor Authentication (2FA), leading to full Grav instance takeover.

grav-plugin-api privilege-escalation vulnerability grav
1t 1c