high8.7
CVE-2026-86193
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-a…
Impact
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.
Affected products
| Product | Affected versions |
|---|---|
| Grav-Plugin-Api | before 1.0.20 |
Versions were read from the advisory text. No structured product data has been published for this record yet.