CVE-2026-42843

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736	Exploit Vendor Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta1::::::
	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta10::::::
	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta11::::::
	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta12::::::
	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta13::::::
	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta14::::::
	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta2::::::
	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta3::::::
	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta4::::::
	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta5::::::
	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta6::::::
	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta7::::::
	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta8::::::
	cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta9::::::

History

No history.

Information

Published : 2026-05-11 17:16

Updated : 2026-06-17 10:48

NVD link : CVE-2026-42843

Mitre link : CVE-2026-42843

CVE.ORG link : CVE-2026-42843

JSON object : View

Products Affected

getgrav

grav-plugin-api

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-42843", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42843", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-11T18:51:01.009552Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getgrav", "product": "grav-plugin-api", "versions": [{"status": "affected", "version": "< 1.0.0-beta.15"}]}]}], "published": "2026-05-11T17:16:34.013", "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15."}], "lastModified": "2026-06-17T10:48:29.810", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F3C40EA-4F3E-437A-9071-06A87C63B7A8"}, {"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A921924F-AF3D-4AE1-B706-1D6027E74F40"}, {"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5166862A-FD6C-4720-A349-148F5A7D6DFE"}, {"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CA7339D-4485-4264-B506-C91B48A3815F"}, {"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta13:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73CA85A4-D143-4ED4-824A-29237A80999C"}, {"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta14:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A62EE6B2-A8B0-4B9F-A210-D3B7ACCAD899"}, {"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8BEBE24F-CC10-4B00-9E2C-F06AFE45ECF7"}, {"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4568EBB-90F7-4434-9707-1CEF1447766B"}, {"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7C478BB-2A35-4060-82E1-527840659B79"}, {"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FAC0BF02-4C89-43D3-A153-D071950E9562"}, {"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13B23E1C-26E0-42D0-86A9-268542E9AE42"}, {"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA2CE0E8-02EF-4AAD-8E3D-0207C9431345"}, {"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3F415AF-C552-48BE-983B-8F6D44A7454E"}, {"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB5B8655-AC94-4986-B7DD-E1F145EAED5F"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}