vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-86195

grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag

HIGH
8.7
CVSS Score
Published: September 5, 2026 at 12:09 PM UTC
Updated: September 8, 2026 at 08:19 PM UTC
2 products affected across 1 vendorGravGrav Plugin API

Using grav-plugin-api by getgrav?

Get instant alerts when new vulnerabilities affect grav-plugin-api - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.7
Exploit prediction
EPSS 0.4%
SSVC
PoC

Description

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write permissions can create an invitation with a dot-keyed super flag in the access payload that bypasses the guard and persists to the new account. Attackers can accept the invitation through the public endpoint without real invitee interaction to create a super-admin account and immediately receive a valid JWT for full site control.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Grav· Getgravcomposer
95%
v < 1.0.20
Affected range stops below 1.0.20, so it looks safe — our inference, not a vendor statement
Grav Plugin API· Getgrav
60%
v < 1.0.20
Vendor states this is fixed in 1.0.20 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

Vendor Advisory
Source: cverecord
https://github.com/getgrav/grav/security/advisories/GHSA-m363-3hww-gcwc
Third Party Advisory
Source: cverecord
https://www.vulncheck.com/advisories/grav-plugin-api-1.0.0-through-1.0.19-privilege-escalation-via-dot-keyed-super-flag

SSVC — Action Prioritization

SSVCPoCNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.7HIGHVulnCheck
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-269

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card