# CVE-2026-86193: Grav API Plugin authorization bypass in user-management guards

Source: https://junglewise.ai/threats/cve-2026-86193-grav-api-plugin-authorization-bypass-in-user-management-guards  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86193 · Severity: info · CVSS 8.7 · Published 2026-09-05

Grav's API plugin fails to properly check whether user accounts inherit super-admin permissions through group membership. A user manager with limited permissions can exploit this to modify the passwords of group-based super-admin accounts and gain full administrative control over the entire Grav installation, including the ability to install plugins and access all site data.

Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-86193 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86193 being exploited in the wild.

**How severe is CVE-2026-86193?** Informational severity, with a CVSS score of 8.7, published 5 September 2026.

**Which products and versions are affected?** Grav-Plugin-Login before 3.9.3.

**Is there a fix for CVE-2026-86193?** A patch was published on 2026-09-05: grav-plugin-api 1.0.20, grav-plugin-login 3.9.3, grav-plugin-admin 1.10.56 / 1.11.0-beta.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86193 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86193?** Check whether you run Grav-Plugin-Login at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The grav-plugin-api's user-management guards check only the target account's own access map for super-admin permissions, ignoring permissions inherited through group membership. The vulnerable code in UsersController::update() and related endpoints reads accessGrantsSuper($target->get('access')), which fails when super permissions are assigned at the group level rather than directly to the account. An attacker with api.access and api.users.write permissions (a documented delegation tier for user managers) can PATCH a group-super account's password field to take full control, while the same request against an account with a direct super flag is correctly rejected. This bypasses multiple prior authorization fix attempts (GHSA-p97c, GHSA-94q7, GHSA-8gg4, GHSA-22p9, GHSA-985r), all of which also read only direct access. The fix resolves super permissions across both the account's own access map and all groups it belongs to.

## Affected products

- Grav grav-plugin-api before 1.0.20
- Grav grav-plugin-login before 3.9.3
- Grav grav-plugin-admin before 1.10.56 / 1.11.0-beta.6

## Timeline

- 2026-08-21: disclosed
- 2026-09-05: advisory
- 2026-09-05: patched: grav-plugin-api 1.0.20, grav-plugin-login 3.9.3, grav-plugin-admin 1.10.56 / 1.11.0-beta.6

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-vv8m-jqpm-38x4](https://github.com/getgrav/grav/security/advisories/GHSA-vv8m-jqpm-38x4)
- [https://www.vulncheck.com/advisories/grav-api-plugin-authentication-bypass-via-group-inherited-super](https://www.vulncheck.com/advisories/grav-api-plugin-authentication-bypass-via-group-inherited-super)

## Related threats

- [Grav login plugin timing attack in password reset and activation tokens](https://junglewise.ai/threats/cve-2026-72700-grav-login-plugin-timing-attack-in-password-reset-and-activation)