High severityNVD Advisory· Published Sep 5, 2026

CVE-2026-86193

Description

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Getgrav/Grav Plugin APIllm-fuzzy
Range: <1.0.20
Getgrav/Gravllm-fuzzy
Range: <1.0.20

Patches

Vulnerability mechanics

References

github.com/getgrav/grav/security/advisories/GHSA-vv8m-jqpm-38x4nvd
www.vulncheck.com/advisories/grav-api-plugin-authentication-bypass-via-group-inherited-supernvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000