https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T04:41:20.403471+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-86193 CVE-2026-86193 — Grav API Plugin Authentication Bypass via Group-Inherited Super 2026-10-04T04:41:20.421229+00:00

Affected: getgrav grav-plugin-api

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.