CVE-2026-42843

High

Description

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.

SeverityHigh

CVSS8.8

Exploit probability—

ProductGetgrav Grav-plugin-api

PublishedMay 11, 2026

First seenMay 11, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

getgrav/grav-plugin-api1.0.0-beta.15 or later

Affected products

Product	Affected versions	Fixed in
getgrav grav-plugin-api	1.0.0	—
getgrav/grav-plugin-apiPackagist	v < 1.0.0-beta.15	1.0.0-beta.15

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.