CVE-2026-42843

{
  "id": "CVE-2026-42843",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T17:16:34.013",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15."
    },
    {
      "lang": "es",
      "value": "Grav API Plugin es una API RESTful para Grav CMS que proporciona acceso completo sin interfaz al contenido, medios, configuración, usuarios y gestión del sistema de su sitio. Antes de la 1.0.0-beta.15, una referencia directa a objeto insegura y un fallo lógico en el plugin Grav API (UsersController::update) permite a cualquier usuario autenticado con acceso básico a la API (api.access) modificar su propia configuración de permisos. Un atacante puede explotar esto para escalar sus privilegios a Super Administrador (admin.super y api.super), lo que lleva a un compromiso total del sistema y potencial RCE. Esta vulnerabilidad está corregida en la 1.0.0-beta.15."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "getgrav",
          "product": "grav-plugin-api",
          "versions": [
            {
              "version": "< 1.0.0-beta.15",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-11T18:51:01.009552Z",
          "id": "CVE-2026-42843",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "0F3C40EA-4F3E-437A-9071-06A87C63B7A8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta10:*:*:*:*:*:*",
              "matchCriteriaId": "A921924F-AF3D-4AE1-B706-1D6027E74F40"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta11:*:*:*:*:*:*",
              "matchCriteriaId": "5166862A-FD6C-4720-A349-148F5A7D6DFE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta12:*:*:*:*:*:*",
              "matchCriteriaId": "5CA7339D-4485-4264-B506-C91B48A3815F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta13:*:*:*:*:*:*",
              "matchCriteriaId": "73CA85A4-D143-4ED4-824A-29237A80999C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta14:*:*:*:*:*:*",
              "matchCriteriaId": "A62EE6B2-A8B0-4B9F-A210-D3B7ACCAD899"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "8BEBE24F-CC10-4B00-9E2C-F06AFE45ECF7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "A4568EBB-90F7-4434-9707-1CEF1447766B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "F7C478BB-2A35-4060-82E1-527840659B79"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "FAC0BF02-4C89-43D3-A153-D071950E9562"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta6:*:*:*:*:*:*",
              "matchCriteriaId": "13B23E1C-26E0-42D0-86A9-268542E9AE42"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta7:*:*:*:*:*:*",
              "matchCriteriaId": "EA2CE0E8-02EF-4AAD-8E3D-0207C9431345"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta8:*:*:*:*:*:*",
              "matchCriteriaId": "E3F415AF-C552-48BE-983B-8F6D44A7454E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getgrav:grav-plugin-api:1.0.0:beta9:*:*:*:*:*:*",
              "matchCriteriaId": "DB5B8655-AC94-4986-B7DD-E1F145EAED5F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}