CVE-2026-86193

grav-plugin-api, the REST API plugin for the Grav CMS, fails to enforce group-inherited 'super' permission checks in its user-management guards, an incorrect-authorization flaw (CWE-863). An authenticated API caller holding api.access and api.users.write — such as a delegated user manager who is not a super user — can issue patch/update requests against accounts in a group with super permissions, including changing their password fields. By resetting a super-admin's password in this way, the attacker gains full administrative control of the Grav site. Any deployment running grav-plugin-api before 1.0.20 in which non-super users have been granted API user-management permissions is affected. No public proof-of-concept is known, no in-the-wild exploitation has been confirmed, and EPSS currently estimates only about a 0.2% chance of exploitation within 30 days.

What to do: Upgrade grav-plugin-api to 1.0.20 or later. As an interim mitigation, revoke api.users.write from non-super users and restrict user-management API access to super users. Review API logs for patch/update calls touching group-super (super-admin) accounts made by non-super users, and check whether any super-admin passwords were changed unexpectedly.