Grav API Privilege Escalation to Super Admin
Date: 2026-05
Affected: composer/getgrav/grav-plugin-api
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-42843
CWE: CWE-863
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

### Summary An insecure direct object reference and logic flaw in the Grav API plugin (`UsersController::update`) allows any authenticated user with basic API access (`api.access`) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (`admin.super` and `api.super`), leading to full system compromise and potential RCE. ### Details The vulnerability is located in `user/plugins/api/classes/Api/Controllers/UsersController.php` within the `update` method. The API allows users to update their own profiles if they possess the basic `api.access` permission: ```php // UsersController.php -> update() $isSelf = $currentUser->username === $username; if (!$isSelf) { $this->requirePermission($request, 'api.users.write'); } else { // Self-edit only requires api.access $this->requirePermission($request, 'api.access'); } ``` However, when filtering the fields that are allowed to be updated via a `PATCH` request, the `access` field (which defines the user's role and permissions) is indiscriminately included in the `$allowedFields` whitelist for all users: ```php // Partial update - only update provided fields $allowedFields = ['email', 'fullname', 'title', 'state', 'language', 'content_editor', 'access', 'twofa_enabled']; foreach ($allowedFields as $field) { if (array_key_exists($field, $body)) { $user->set($field, $body[$field]); } } ``` Because there is no secondary check to verify i


Mitigations:

Architectural layers (MAESTRO):