https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T22:55:37.558857+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-08997 bdu:2026-08997 2026-10-15T22:55:37.619348+00:00 bdu:2026-08997 https://cve.radiocsirt.org/vuln/euvd-2026-310811 EUVD-2026-310811 2026-10-15T22:55:37.619390+00:00 EUVD-2026-310811 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42843 fkie_cve-2026-42843 2026-10-15T22:55:37.619405+00:00

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.

 https://cve.radiocsirt.org/vuln/ghsa-r945-h4vm-h736 GHSA-r945-h4vm-h736 — Grav API Privilege Escalation to Super Admin 2026-10-15T22:55:37.619441+00:00

Affected: Packagist: getgrav/grav-plugin-api

### Summary

An insecure direct object reference and logic flaw in the Grav API plugin (`UsersController::update`) allows any authenticated user with basic API access (`api.access`) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (`admin.super` and `api.super`), leading to full system compromise and potential RCE.

### Details

The vulnerability is located in `user/plugins/api/classes/Api/Controllers/UsersController.php` within the `update` method.

The API allows users to update their own profiles if they possess the basic `api.access` permission:

```php // UsersController.php -> update() $isSelf = $currentUser->username === $username; if (!$isSelf) { $this->requirePermission($request, 'api.users.write'); } else { // Self-edit only requires api.access $this->requirePermission($request, 'api.access'); } ```

However, when filtering the fields that are allowed to be updated via a `PATCH` request, the `access` field (which defines the user's role and permissions) is indiscriminately included in the `$allowedFields` whitelist for all users:

```php // Partial update - only update provided fields $allowedFields = ['email', 'fullname', 'title', 'state', 'language', 'content_editor', 'access', 'twofa_enabled']; foreach ($allowedFields as $field) { if (array_key_exists($field, $body)) { $user->set($field, $body[$field]); } } ```

Because there is no secondary check to verify…