---
id: CVE-2026-109317
title: >-
  Grav grav-plugin-api before 1.0.36 contains a privilege escalation
  vulnerability that allows delegated user managers to obtain super-admin access
  by storing positive scalar admin or api parent grants
summary: >-
  Grav grav-plugin-api before 1.0.36 contains a privilege escalation
  vulnerability that allows delegated user managers to obtain super-admin access
  by storing positive scalar admin or api parent grants. Attackers with
  api.users.write can e…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-269
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:26.653'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109317'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-m2rq-76vx-vv4j'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.36-privilege-escalation-via-scalar-access-grants
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.200Z'
---

## Overview

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.