Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-42843 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to … https://www.cve.org/CVERecord?id=CVE-2026-42843
Post summary
The passage presents a brief disclosure of CVE‑2026‑42843, noting that the Grav API Plugin exposes extensive site controls via a RESTful interface; it contains no PoC, exploit, or mitigation details.
14 of 14 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |
| App | getgrav | grav-plugin-api | 1.0.0 | - | - |