Grav API Plugin: Privilege escalation to super-admin via scalar access grants
Summary
The Grav API plugin before 1.0.36 lets a delegated user manager store scalar admin or api parent grants in account access maps or invitations. The permission resolver inherits these grants, so the super-admin check passes and the attacker can reach super-only API endpoints. An attacker needs an account with api.users.write, which is typically held by delegated user managers, and the plugin must be installed and enabled.
Affected
- getgrav/grav-plugin-api versions before 1.0.36 (CNA range 0 to < 1.0.36; VulDB and OSV list up to 1.0.35)
- Unknown whether earlier releases are affected; treat all versions before 1.0.36 as affected
Fixed in
- Fixed in 1.0.36 (release notes: blanket admin or api grants no longer count as super user; invitations can no longer carry super)
- Latest release recommended, as other authorization flaws were fixed in later versions (for example 1.0.6, 1.0.10 and 1.0.13)
Workaround
- Unknown. No workaround found if the patch cannot be applied.
- Restrict API access to trusted networks or VPN.
- Limit delegated user management to a small number of trusted accounts.
- Manually remove existing scalar admin or api parent grants from account and invitation records.
Exploitation
- Known exploited: not found.
- Public proof of concept: none found; this does not prove that none exists.
- EPSS: 0.0036.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether grav-plugin-api is installed and which version runs.
- Update to 1.0.36 or, preferably, the latest release.
- Audit accounts with api.users.write and review their access and invitation records for super or api-parent grants.
- Restrict API exposure and limit delegated user management to trusted accounts.
- Monitor for unexpected super-admin changes on the site.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-m2rq-76vx-vv4j github.com
- VulnCheck advisory www.vulncheck.com
- grav-plugin-api release 1.0.36 github.com
- OSV CVE-2026-109317 osv.dev
- VulDB 417110 vuldb.com
- Rapid7 via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:43.
Original description (NVD)
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.