PT-2026-37282 · Grav · Grav-Plugin-Api

N0Tra4E · Published 2026-05-05 · Updated 2026-05-27 · CVE-2026-42843

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.0-beta.15

Description An insecure direct object reference and logic flaw in the update() function of the UsersController allows any authenticated user with basic api.access permissions to modify their own permission configuration. By sending a PATCH request to the user update endpoint, an attacker can overwrite the access variable to grant themselves Super Administrator privileges (admin.super and api.super). This vertical privilege escalation can lead to full system compromise and potential remote code execution (RCE) by allowing the attacker to modify configurations or upload malicious plugins.

Recommendations Update Grav API Plugin to version 1.0.0-beta.15.

Exploit

Fix

RCE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-42843

GHSA-R945-H4VM-H736

Affected Products

Grav-Plugin-Api

References · 7

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736 · Exploit
• https://osv.dev/vulnerability/GHSA-r945-h4vm-h736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42843 · Security Note
• https://github.com/getgrav/grav · Note
• https://github.com/getgrav/grav-plugin-api/commit/26f529c7d438c73343e82311fb095caeaf1a6116 · Note
• https://t.me/cveNotify/164900 · Telegram Post
• https://twitter.com/CVEnew/status/2053932459553886305 · Twitter Post