CVE-2026-86195 Overview
CVE-2026-86195 is a privilege escalation vulnerability in the grav-plugin-api component used by the Grav content management system. Versions prior to 1.0.20 contain a flawed guard in the InvitationsController that fails to sanitize dot-keyed representations of the super permission flag. A low-privileged user manager holding api.access and api.users.write permissions can craft an invitation that persists super-admin rights to a new account. The attacker then accepts the invitation through the public endpoint, bypassing the intended invitee interaction, and receives a valid JSON Web Token (JWT) granting full site control. The weakness is categorized under [CWE-269: Improper Privilege Management].
Critical Impact
Authenticated attackers with limited user-management permissions can create super-admin accounts and obtain valid JWTs, resulting in full compromise of the Grav site.
Affected Products
- Grav CMS with grav-plugin-api versions 1.0.0 through 1.0.19
- Deployments exposing the invitations API endpoint
- Instances where non-super user managers hold api.access and api.users.write
Discovery Timeline
- 2026-09-05 - CVE-2026-86195 published to the National Vulnerability Database (NVD)
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-86195
Vulnerability Analysis
The defect resides in the stripSuperFlags() method within the InvitationsController. The method is intended to remove any super permission flag from the access payload of an invitation, ensuring that only super-admins can grant super-admin rights. It performs this sanitization only against nested key structures, such as api: { super: true }, and does not recognize equivalent dot-keyed representations like api.super. Because the Grav permission model treats both notations as functionally equivalent when persisted, the sanitization guard is incomplete.
A user manager with api.access and api.users.write submits an invitation whose access payload contains a dot-keyed super flag. The guard passes, the invitation is stored with the elevated flag intact, and the resulting account inherits super-admin authority. The public invitation-acceptance endpoint completes account creation and issues a JWT for the new super-admin identity without additional verification.
Root Cause
The root cause is inconsistent key normalization between the input validator and the persistence layer. stripSuperFlags() enforces a denylist against a single serialization format while the downstream permission engine honors multiple equivalent formats. This mismatch produces an authorization bypass classified as improper privilege management.
Attack Vector
Exploitation requires network access to the API endpoint and a low-privileged authenticated session with user-management permissions. No user interaction from a legitimate invitee is required, because the attacker accepts the invitation directly through the public endpoint. See the GitHub Security Advisory and the VulnCheck Privilege Escalation Advisory for technical details.
Detection Methods for CVE-2026-86195
Indicators of Compromise
- Invitation records whose access payload contains dot-keyed permission keys such as api.super, admin.super, or any *.super variant.
- New user accounts created shortly after an invitation was issued by a non-super user manager.
- JWT issuance events for freshly created accounts that carry super-admin claims.
- Unexpected changes to site configuration, plugins, or user roles by newly provisioned accounts.
Detection Strategies
- Audit stored invitation payloads for any occurrence of a super flag, in either nested or dot-keyed form, that was created by a non-super issuer.
- Correlate invitation creation events with subsequent account acceptance and JWT issuance from the public endpoint.
- Alert when a user account transitions to super-admin status without a corresponding action performed by an existing super-admin.
Monitoring Recommendations
- Enable verbose logging on the InvitationsController and the public invitation-acceptance endpoint.
- Forward Grav application and web server logs to a centralized analytics pipeline for retention and query.
- Monitor authentication logs for JWT issuance patterns tied to newly created accounts.
How to Mitigate CVE-2026-86195
Immediate Actions Required
- Upgrade grav-plugin-api to version 1.0.20 or later on all Grav deployments.
- Review all invitations issued during the exposure window and revoke any that contain a super flag in either notation.
- Audit the current super-admin user list and remove any accounts that cannot be tied to a legitimate provisioning event.
- Rotate JWT signing secrets to invalidate any tokens issued to unauthorized super-admin accounts.
Patch Information
The maintainers of grav-plugin-api released version 1.0.20, which extends stripSuperFlags() to normalize and reject dot-keyed super flags in addition to nested structures. Refer to the GitHub Security Advisory for the fix commit and upgrade guidance.
Workarounds
- Temporarily revoke api.users.write from all non-super user managers until the upgrade is applied.
- Restrict network access to the invitations API and the public invitation-acceptance endpoint using a web application firewall or reverse proxy allowlist.
- Disable the invitations feature entirely if user provisioning can be handled out-of-band during the remediation window.
# Configuration example: upgrade the plugin via Grav CLI
bin/gpm update api
bin/gpm version api
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
