CVE-2026-86193: Grav API Plugin Privilege Escalation Flaw

CVE-2026-86193 Overview

CVE-2026-86193 affects the grav-plugin-api package before version 1.0.20. The plugin fails to validate group-inherited super permissions in user-management guards. Non-super user managers can modify super-admin accounts through the API. Attackers holding api.access and api.users.write permissions can patch password fields on group-super accounts. Successful exploitation grants full administrative control over the Grav content management system. The flaw is classified as [CWE-863: Incorrect Authorization].

Critical Impact
Authenticated low-privilege users can hijack super-admin accounts and gain complete control of the Grav CMS instance.

Affected Products

Grav CMS grav-plugin-api versions before 1.0.20
Grav installations with the API plugin enabled
Deployments using group-inherited super permissions

Discovery Timeline

2026-09-05 - CVE-2026-86193 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86193

Vulnerability Analysis

The grav-plugin-api package exposes user-management endpoints protected by permission guards. These guards check whether a caller holds super-admin rights before allowing modifications to privileged accounts. The check evaluates only permissions assigned directly to the user account. It does not evaluate permissions inherited from group membership.

The result is an authorization gap. A user without a direct super permission but with api.access and api.users.write can invoke PATCH operations against accounts whose super rights derive from group membership. Password fields on those group-super accounts can be overwritten. The attacker then authenticates as the compromised super-admin and pivots to full platform control.

Root Cause

The user-management guard logic performs an incomplete permission resolution. Group-inherited privileges are omitted from the effective-permission calculation used to protect super accounts. This is a broken access control pattern where the authorization decision uses a different permission model than the runtime enforcement layer.

Attack Vector

Exploitation requires authenticated API access with api.access and api.users.write scopes. The attacker sends a PATCH request to the user endpoint targeting a group-super account and supplies a new password value. Because the guard treats the target as non-super, the request succeeds. The attacker then logs in with the new credentials. Refer to the GitHub Security Advisory GHSA-vv8m-jqpm-38x4 and the VulnCheck Advisory on Grav API for the technical breakdown.

Detection Methods for CVE-2026-86193

Indicators of Compromise

Unexpected PATCH requests against /api/users/* endpoints originating from accounts without direct super-admin rights
Password field changes on accounts that belong to super-privileged groups without a corresponding administrative ticket
New or unfamiliar successful logins for super-admin accounts following API activity from lower-privileged users
Modifications to user/accounts/*.yaml files outside routine administration windows

Detection Strategies

Audit Grav API access logs for PATCH operations targeting user records that contain super-group membership
Correlate api.users.write calls with the caller's direct role assignments to identify privilege mismatches
Alert on password resets performed via the API against accounts flagged as super-admin

Monitoring Recommendations

Enable verbose logging on the Grav API plugin and forward logs to a centralized SIEM for retention
Baseline normal user-management API usage and alert on deviations by caller identity or target account
Monitor authentication events for super-admin accounts and flag logins that follow recent password changes

How to Mitigate CVE-2026-86193

Immediate Actions Required

Upgrade grav-plugin-api to version 1.0.20 or later on all Grav instances
Rotate credentials for every super-admin account and any account with group-inherited super rights
Review recent API audit logs for unauthorized PATCH activity against user accounts
Revoke api.users.write from any account that does not require user-management capability

Patch Information

The maintainers fixed the flaw in grav-plugin-api version 1.0.20 by resolving group-inherited permissions during guard evaluation. Administrators should update through the Grav plugin manager or via bin/gpm update api. Consult the GitHub Security Advisory GHSA-vv8m-jqpm-38x4 for the fix commit reference.

Workarounds

Disable the Grav API plugin until the upgrade is applied if patching is not immediately feasible
Restrict access to API endpoints at the reverse proxy or web application firewall layer to trusted management IP ranges
Remove group-inherited super assignments and grant super rights only through direct account permissions until patched

bash

# Configuration example
# Update the Grav API plugin to the fixed release
bin/gpm update api

# Verify installed version
bin/gpm info api | grep -i version