CVE-2026-42843 grav-plugin-api: Grav API Privilege Escalation to Super Admin
Authenticated users can escalate privileges to Super Administrator via insecure direct object reference in the Grav API plugin, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42843?
CVE-2026-42843 is a high-severity vulnerability in getgrav grav-plugin-api, published on 11 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.
Weakness: CWE-863
Which versions are affected by CVE-2026-42843?
2 open source packages ship an affected version, including getgrav/grav-plugin-api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
getgrav/grav-plugin-api Packagist | All versions | 1.0.0-beta.15 |
getgrav/grav-plugin-api Packagist | All versions | 1.0.0-beta.15 |
Products include Getgrav Grav-Plugin-Api.
How do I fix CVE-2026-42843?
Upgrade getgrav/grav-plugin-api to 1.0.0-beta.15 or later.
Is CVE-2026-42843 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42843 exists.
Sources
Also known as GHSA-r945-h4vm-h736.