CVE-2026-42843— grav-plugin-api: Grav API Privilege Escalation to Super Admin
Possible ATT&CK Techniques 1AI
T1078.003 · Local AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| getgrav | grav-plugin-api | < 1.0.0-beta.15 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-42843
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
grav-plugin-api: Grav API Privilege Escalation to Super Admin
Source: NVD (National Vulnerability Database)
Vulnerability Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Vulnerability Title
Grav CMS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Grav CMS是Grav开源的一个基于文件的扁平化内容管理系统。 Grav CMS 1.0.0-beta.15之前版本存在安全漏洞，该漏洞源于不安全的直接对象引用和逻辑缺陷，可能导致认证用户修改自身权限配置并提升为超级管理员。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| getgrav | grav-plugin-api | < 1.0.0-beta.15 | - |
II. Public POCs for CVE-2026-42843
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42843
请登录查看更多情报信息。
- https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-42843
Same Patch Batch · getgrav · 2026-05-11 · 13 CVEs total
| CVE-2026-42613 | 9.4 CRITICAL | Grav: Privilege Escalation via Missing Server-Side Validation of groups/access |
| CVE-2026-42607 | 9.1 CRITICAL | Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Featur |
| CVE-2026-42611 | 8.9 HIGH | Grav: Stored XSS via Tag Injection |
| CVE-2026-42612 | 8.5 HIGH | Grav: Publisher-Level Stored XSS via Unquoted Event Attributes |
| CVE-2026-42609 | 8.1 HIGH | Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Log |
| CVE-2026-44738 | 7.7 HIGH | Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::t |
| CVE-2026-42610 | 6.5 MEDIUM | Grav: Sensitive Information Disclosure via Accounts Service Bypass |
| CVE-2026-42842 | 5.4 MEDIUM | grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel |
| CVE-2026-42608 | Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component. | |
| CVE-2026-42845 | Grav: Anonymous Page Content Overwrite via Form File Upload filename Override | |
| CVE-2026-42841 | Grav: Stored XSS via Markdown media attribute() action in Grav CMS | |
| CVE-2026-44737 | grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page |
IV. Related Vulnerabilities
Same vendor: getgrav
- CVE-2026-42844
Grav: Low-privileged API users can create super-admin accoun - CVE-2026-44737
grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflect - CVE-2026-44738
Grav: Twig sandbox allows editor-role users to exfiltrate al - CVE-2026-42845
Grav: Anonymous Page Content Overwrite via Form File Upload - CVE-2026-42842
grav-plugin-form: XSS via Taxonomy Field Values in Admin Pan
Same weakness: CWE-863
- CVE-2026-21789
HCL Connections is vulnerable to broken access control - CVE-2026-28732
Slash command trigger-word update allowed command hijacking - CVE-2026-6343
Mattermost Playbooks Plugin fails to enforce view permission - CVE-2026-4286
Playbooks Plugin fails to validate team transfers, allowing - CVE-2026-6341
Incomplete group locking implementation
V. Comments for CVE-2026-42843
No comments yet