CVE-2026-86195

grav-plugin-api versions before 1.0.20 contain a privilege escalation flaw (CWE-269) in the InvitationsController, where the stripSuperFlags() guard removes nested super flags but fails to strip their dot-keyed equivalents such as 'api.super'. A non-super user manager holding api.access and api.users.write permissions can create an invitation whose access payload includes a dot-keyed super flag, bypassing the guard so the flag persists onto the account created by that invitation. Because the invitation can be accepted through a public endpoint without any interaction from the real invitee, an attacker can mint a super-admin account and immediately obtain a valid JWT granting full control of the site. Any Grav CMS deployment running the API plugin below version 1.0.20, particularly where user-management API permissions have been delegated to non-super users, is affected. Exploitation is not currently observed: there is no known public PoC, the issue is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade grav-plugin-api to version 1.0.20 or later. Until patched, restrict or review accounts holding api.access and api.users.write, and consider disabling the API plugin or the public invitation-acceptance endpoint if delegated user management is not required. Administrators should also audit recently created accounts for unexpected 'api.super' style flags and rotate/shorten the lifetime of any JWTs issued via invitations.