CVE-2026-109317
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows…
- Risk score
- 49/100
- CVSS
- 7.2 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satis…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.0.36 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.2 high
References
Original description
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.
Last activity 12 Oct 2026. Patch Forecast updates every hour.