High severity · published Oct 12, 2026
CVE-2026-109317
Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav-plugin-api · getgrav
before 1.0.36 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109317
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109317
vendor-advisory
https://github.com/getgrav/grav/security/advisories/GHSA-m2rq-76vx-vv4j
third-party-advisory
https://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.36-privilege-escalation-via-scalar-access-grants
More from grav-plugin-api
9.8
CVE-2026-112779
Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
9.4
CVE-2026-62668
Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols
8.8
CVE-2026-62666
Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super
8.8
CVE-2026-72833
Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys
8.8
CVE-2026-42843
grav-plugin-api: Grav API Privilege Escalation to Super Admin