CVE-2026-42843
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
68/100
Published: 2026-05-11
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.
Weakness Classification (1)
Affected Software (14)
| Vendor | Product | Version |
|---|---|---|
| getgrav | grav-plugin-api | 1.0.0 |
| getgrav | grav-plugin-api | 1.0.0 |
| getgrav | grav-plugin-api | 1.0.0 |
| getgrav | grav-plugin-api | 1.0.0 |
| getgrav | grav-plugin-api | 1.0.0 |
| getgrav | grav-plugin-api | 1.0.0 |
| getgrav | grav-plugin-api | 1.0.0 |
| getgrav | grav-plugin-api | 1.0.0 |
| getgrav | grav-plugin-api | 1.0.0 |
| getgrav | grav-plugin-api | 1.0.0 |
| getgrav | grav-plugin-api | 1.0.0 |
| getgrav | grav-plugin-api | 1.0.0 |
| getgrav | grav-plugin-api | 1.0.0 |
| getgrav | grav-plugin-api | 1.0.0 |
References & Advisories (1)
Exploit
Vendor Advisory