Executive brief
Grav's API plugin fails to properly check whether user accounts inherit super-admin permissions through group membership. A user manager with limited permissions can exploit this to modify the passwords of group-based super-admin accounts and gain full administrative control over the entire Grav installation, including the ability to install plugins and access all site data.
Technical details
The grav-plugin-api's user-management guards check only the target account's own access map for super-admin permissions, ignoring permissions inherited through group membership. The vulnerable code in UsersController::update() and related endpoints reads accessGrantsSuper($target->get('access')), which fails when super permissions are assigned at the group level rather than directly to the account. An attacker with api.access and api.users.write permissions (a documented delegation tier for user managers) can PATCH a group-super account's password field to take full control, while the same request against an account with a direct super flag is correctly rejected. This bypasses multiple prior authorization fix attempts (GHSA-p97c, GHSA-94q7, GHSA-8gg4, GHSA-22p9, GHSA-985r), all of which also read only direct access. The fix resolves super permissions across both the account's own access map and all groups it belongs to.
Affected products
- Grav grav-plugin-api before 1.0.20
- Grav grav-plugin-login before 3.9.3
- Grav grav-plugin-admin before 1.10.56 / 1.11.0-beta.6
Timeline
- 2026-08-21: disclosed
- 2026-09-05: advisory
- 2026-09-05: patched: grav-plugin-api 1.0.20, grav-plugin-login 3.9.3, grav-plugin-admin 1.10.56 / 1.11.0-beta.6