CVE-2026-86193— Grav API Plugin Authentication Bypass via Group-Inherited Super
Quick assessment
Affected
getgrav grav-plugin-api
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
漏洞描述翻译： Grav 插件 在版本 1.0.20 之前，在用户管理守卫（guards）中未能验证通过组继承的超级权限，导致非超级用户的用户管理员能够修改超级管理员账户。拥有 和 权限的攻击者，可以修改通过组继承超级权限的账户的密码字段，从而获得完全的管理员控制权。
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| getgrav | grav-plugin-api | < 1.0.20 |
affected |
1.0.20 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86193
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Grav API Plugin Authentication Bypass via Group-Inherited Super
Source: CVE Program / CVE List V5
Vulnerability Description
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| getgrav | grav-plugin-api | 0 ~ 1.0.20 | - |
|
II. Public POCs for CVE-2026-86193
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86193
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-86193 (2)
Same Patch Batch · getgrav · 2026-09-05 · 5 CVEs total
| CVE-2026-86196 | 8.7 HIGH | Grav API Plugin before 1.0.20 Authentication Bypass via Host Header |
| CVE-2026-86195 | 8.7 HIGH | grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag |
| CVE-2026-86194 | 6.9 MEDIUM | Grav Form Plugin before 9.1.22 Cross-Page Form Execution |
| CVE-2026-86197 | 5.1 MEDIUM | Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox |
IV. Related Vulnerabilities
Same product: grav-plugin-api
-
CVE-2026-86196
Grav API Plugin before 1.0.20 Authentication Bypass via Host -
CVE-2026-86195
grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation vi -
CVE-2026-64852
Grav API Plugin: Missing authorization on API-key generate/r -
CVE-2026-63408
Grav API Plugin: JWT Access Token Accepted via `?token=` URL -
CVE-2026-63407
Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Au
Same vendor: getgrav
-
CVE-2026-86197
Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox -
CVE-2026-86196
Grav API Plugin before 1.0.20 Authentication Bypass via Host -
CVE-2026-86195
grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation vi -
CVE-2026-86194
Grav Form Plugin before 9.1.22 Cross-Page Form Execution -
CVE-2026-85603
Grav Admin Plugin Path Traversal via Save As Language Code
Same weakness: CWE-863
-
CVE-2026-16941
IBM i is Affected By An Incorrect Authorization Vulnerabilit -
CVE-2026-19283
IBM Instana Observability is affected by multiple vulnerabil -
CVE-2026-85697
Documenso 2.17.0 PDF Route Ignores Document Visibility -
CVE-2026-85622
AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read vi -
CVE-2026-85620
Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Claus
V. Comments for CVE-2026-86193
No comments yet