CVE-2026-86193 — Grav API Plugin Authentication Bypass via Group-Inherited Super
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Att…
Published: 2026-09-05 · CVSS: 8.7 · CVSS 4.0
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7