CVE-2026-62233: Grav Plugin API Privilege Escalation Flaw

CVE-2026-62233 Overview

CVE-2026-62233 is a privilege escalation vulnerability in the grav-plugin-api extension for the Grav flat-file content management system (CMS). Versions before 1.0.6 fail to validate super-admin status inside the createApiKey, generate2fa, and disable2fa endpoints. Any account holding the api.users.write permission can mint API keys bound to super-admin users or strip two-factor authentication (2FA) from those accounts. Successful abuse yields full administrative takeover of the affected Grav instance. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
A low-privileged user manager can escalate to super-admin, mint attacker-controlled API keys, and remove 2FA protections on privileged accounts.

Affected Products

Grav CMS grav-plugin-api versions prior to 1.0.6
Grav instances that expose the plugin's user management API
Deployments where any non-super-admin holds the api.users.write capability

Discovery Timeline

2026-07-17 - CVE-2026-62233 published to the National Vulnerability Database (NVD)
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-62233

Vulnerability Analysis

The grav-plugin-api plugin gates several sensitive user management endpoints behind the api.users.write permission. That permission is designed to let user managers create and edit standard accounts. It is not intended to grant control over super-admin identities. Before version 1.0.6, the plugin's createApiKey, generate2fa, and disable2fa handlers check only the caller's write permission. They do not verify whether the target account is a super-admin, nor whether the caller itself holds super-admin status. This is a textbook horizontal-to-vertical privilege escalation caused by a missing target-object authorization check [CWE-639].

Exploitation produces two distinct paths to full compromise. First, an attacker can invoke createApiKey against a super-admin user identifier and receive a valid API key bound to that account. Every subsequent request signed with that key inherits super-admin authority. Second, an attacker can call disable2fa on a super-admin account to strip its second factor, then combine that with credential reuse or password reset workflows to hijack the account interactively.

Root Cause

The root cause is inconsistent authorization logic. The endpoints trust the caller's permission scope without validating the privilege tier of the target user. No comparison is made between the caller's role and the target account's role before mutating security-sensitive attributes such as API keys and 2FA state.

Attack Vector

The attack vector is network-based and requires an authenticated session with the api.users.write permission. No user interaction is required. The attacker sends authenticated HTTP requests to the vulnerable plugin endpoints, supplying a super-admin user identifier as the target. The server returns a super-admin API key or acknowledges 2FA removal, at which point the attacker pivots to full instance control.

See the GitHub Security Advisory GHSA-8gg4-rvvv-cq96 and the VulnCheck Advisory on Grav Plugin for endpoint-level technical detail.

Detection Methods for CVE-2026-62233

Indicators of Compromise

API key creation events where the caller is not a super-admin but the target user is a super-admin
disable2fa or generate2fa calls issued against super-admin accounts by non-super-admin sessions
New API keys appearing on super-admin accounts outside of change-management windows
Sudden absence of 2FA enrollment on previously protected super-admin users

Detection Strategies

Audit the Grav admin log and plugin API log for invocations of createApiKey, generate2fa, and disable2fa and correlate the caller role with the target role
Alert on any state-changing request to the user management API where the response body includes super-admin scope but the session token belongs to a lower-tier role
Baseline normal API key issuance frequency per account and flag statistical outliers

Monitoring Recommendations

Forward Grav web server and PHP-FPM logs to a centralized logging platform for retention and correlation
Monitor authentication events for super-admin accounts, including 2FA enrollment changes and new API key usage from unfamiliar source IPs
Track configuration files under user/accounts/ for unexpected modifications to super-admin YAML entries

How to Mitigate CVE-2026-62233

Immediate Actions Required

Upgrade grav-plugin-api to version 1.0.6 or later on every Grav instance
Rotate all API keys issued to super-admin accounts and invalidate any keys that cannot be attributed to a legitimate administrator
Re-enroll 2FA for all super-admin users and verify that enrollment state is intact
Review the roster of accounts holding api.users.write and remove the permission where it is not required

Patch Information

The maintainers fixed the flaw in grav-plugin-api version 1.0.6 by adding super-admin validation to the affected endpoints. Refer to the GitHub Security Advisory GHSA-8gg4-rvvv-cq96 for the fixed commit and release notes.

Workarounds

Restrict network access to the Grav admin and plugin API endpoints to trusted management networks or a VPN
Temporarily revoke the api.users.write permission from all non-super-admin accounts until patching is complete
Disable the grav-plugin-api plugin on instances that do not require programmatic user management

bash

# Update grav-plugin-api to the fixed release
bin/gpm update api

# Verify installed version is 1.0.6 or later
bin/gpm info api | grep -i version