CVE-2026-109317

Executive Summary

CVE-2026-109317 is a privilege escalation vulnerability in the Grav CMS plugin grav-plugin-api affecting versions before 1.0.36. A delegated user manager holding the api.users.write capability can craft account access maps or invitations so that the plugin's inheriting permission resolver treats a positive scalar parent grant as satisfying super-admin requirements, thereby granting super-admin access to super-only API endpoints. Successful exploitation yields full compromise of the CMS instance's confidentiality, integrity, and availability, but requires authenticated high-privilege access as a precondition.

Technical Analysis

The vulnerability resides in the permission resolution logic of the Grav API plugin. Grav uses an Access Control List (ACL) model in which permissions are inherited, and access decisions can depend on parent grants. The NVD description states that the flaw is triggered when an actor with api.users.write stores "positive scalar admin or api parent grants" in an account access map or invitation. When these stored grants are later evaluated by the "inheriting permission resolver," the resolver incorrectly treats the presence of a positive scalar parent grant as satisfying requireSuper checks. This allows a non-super-admin, delegated user manager to have their actions authorized as though they held super-admin privileges.

The root cause maps to CWE-269 (Improper Privilege Management). The resolver conflates the existence of a positive grant with the higher privilege required for super-only operations, meaning an authorization check for "super" is satisfied by data that only reflects a lesser grant. The attack surface is the authenticated administrative API, specifically the endpoints that write user account access maps and invitations. Because Grav's admin UI and API are typically exposed over the network (AV:N), and exploitation requires valid credentials with api.users.write (PR:H), the vulnerability is not remotely exploitable without authentication, but it is fully network-deliverable to an authenticated, high-privileged attacker.

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, scoring 7.2 (High). Attack complexity is Low because the manipulation follows normal, documented write operations to account access maps or invitations; no race condition or memory corruption is involved. The scope is Unchanged — the privilege gain occurs within the Grav application boundary. Both confidentiality and integrity impacts are High because super-only endpoints can expose or modify sensitive configuration and user data; availability is rated High in the vector as specified.

No public proof-of-concept, exploit code, or Nuclei template is available, and the EPSS score has not been assigned by FIRST.org. No CISA KEV listing exists, so there is no confirmed in-the-wild exploitation at the time of writing.

Exploitation Scenarios

The exploit chain below is inferred strictly from the vulnerability class and the terms named in the NVD description. No public PoC exists; the mechanics are described at the privilege-management level.

1. Reconnaissance/target identification. The attacker identifies a Grav CMS deployment running grav-plugin-api before 1.0.36 that exposes the administrative API and admin interface over the network. Reconnaissance at this stage is limited to confirming the presence of the plugin and reachable admin/API endpoints, since the vulnerability is only triggerable from an authenticated administrative context.

2. Preconditions and access acquisition. The attacker must already hold a valid account with the api.users.write capability. This is a delegated user-manager role — a lower-privileged administrative role than super-admin. The credential requirement (PR:H) is the principal barrier to entry and limits the threat to insider misuse, compromised delegated accounts, or supply-chain/tenant scenarios where a limited admin role is granted.

3. Triggering the flaw class. Using api.users.write, the attacker edits an account access map or creates/modifies an invitation such that a positive scalar admin or api parent grant is stored. Because the inheriting permission resolver treats a positive scalar parent grant as satisfying requireSuper checks, the stored data causes the attacker's subsequent requests to be authorized as super-admin for super-only operations. The manipulation does not require code execution or malformed input — it is an abuse of the permission model's inheritance and scalar-grant handling rather than a memory-safety or injection defect.

4. Payload/execution method at the vulnerability-class level. This is an authorization-bypass / privilege-management vulnerability. The "payload" is the crafted access map or invitation written through the API; execution is the normal authenticated API request against super-only endpoints, which the resolver now permits. No injection string, file path, or shellcode is involved.

5. Post-exploitation impact. With super-admin authorization satisfied, the attacker can reach super-only API endpoints. Based on the CVSS impact ratings (C:H/I:H/A:H), this enables reading and modifying sensitive CMS data and configuration and could disrupt availability, effectively turning a delegated user-manager role into full CMS control. From there an attacker could persist by altering users/permissions, exfiltrate content or secrets exposed through super-only endpoints, or sabotage the site.

Note: No public PoC, exploit code, or Nuclei template is available; the above chain is an inference from the vulnerability class (CWE-269 privilege escalation via flawed permission inheritance) and the specifics stated in the description.

Impact Assessment

Business impact is high for any organization using Grav CMS with grav-plugin-api before 1.0.36 and delegating user-management duties to non-super-admin roles. The confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H), so successful exploitation can lead to full disclosure of CMS content and configuration, unauthorized modification of user accounts and settings, and potential disruption of the affected site. The blast radius is bounded to the individual Grav application scope (S:U), but because the API plugin often governs all authenticated API operations, a full compromise of one Grav instance's control plane is achievable. The attack is network-delivered (AV:N) but gated behind high privileges (PR:H) and requires no user interaction (UI:N). There is no evidence of public exploit tooling or mass exploitation; risk is thus concentrated in environments where delegated administrative roles exist or where a delegated account has been compromised.

Detection Guidance

Sigma Rule

title: Grav API Privilege Escalation via Crafted Access Map or Invitation
id: 8f2c1a7e-4b3d-4c9a-9e21-6d0f7a5c2b10
status: experimental
description: Detects writes to Grav API user access maps or invitations that introduce positive scalar admin or api parent grants, consistent with CVE-2026-109317 privilege escalation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109317
author: valtersit.com threat intelligence
date: 2026/01/01
logsource:
  product: grav
  service: api
detection:
  selection_method:
    http.method:
      - POST
      - PUT
      - PATCH
  selection_endpoint:
    http.url|contains:
      - '/api/users'
      - '/api/invitations'
  selection_grant:
    http.request.body|contains:
      - 'admin'
      - 'api'
  condition: selection_method and selection_endpoint and selection_grant
falsepositives:
  - Legitimate super-admin configuration changes to user permissions
level: high
tags:
  - attack.privilege_escalation
  - attack.t1078
  - cve.2026.109317

YARA Rule

rule CVE_2026_109317_Grav_API_PrivEsc
{
    meta:
        description = "Detects Grav API plugin artifacts referencing privilege-escalation parent grants for CVE-2026-109317"
        author = "valtersit.com threat intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109317"
        date = "2026-01-01"
        severity = "high"

    strings:
        $api = "api.users.write" ascii wide nocase
        $req1 = "requireSuper" ascii wide nocase
        $g1 = "admin" ascii wide nocase
        $g2 = "api" ascii wide nocase

    condition:
        uint32(0) == 0x04034b50 and any of ($api, $req1) and 2 of ($g1, $g2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109317 Grav API privilege escalation attempt via user permission write"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/users"; http.request_body; content:"admin"; http.request_body; content:"api"; reference:cve,2026-109317; classtype:attempted-admin; sid:2026109317; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [http where http.request.method in ("POST","PUT","PATCH") and
        stringContains(http.request.url, "/api/users") and
        stringContains(http.request.body, "admin")]
  [http where http.request.method in ("POST","PUT","PATCH") and
        (stringContains(http.request.url, "/api/users") or
         stringContains(http.request.url, "/api/invitations")) and
        stringContains(http.request.body, "api.users.write")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=grav_api
| search (method=POST OR method=PUT OR method=PATCH)
| search uri_path IN ("/api/users", "/api/invitations", "/api/users/*")
| eval body_lower=lower(coalesce(request_body, body, ""))
| where match(body_lower, "admin") AND match(body_lower, "api")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as endpoints by src_ip, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="grav,web,cve-2026-109317,">
  <rule id="2026109317" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.method">POST|PUT|PATCH</field>
    <field name="http.url">/api/(users|invitations)</field>
    <field name="http.request.body">admin</field>
    <description>CVE-2026-109317: Grav API user permission/invitation write with admin parent grant - possible privilege escalation to super-admin</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>privilege_escalation,cve_2026_109317,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD/CNA data note that grav-plugin-api 1.0.36 addresses the issue, but no vendor advisory, commit, or release artifact has been verified through tracked sources; validate against the official Grav plugin repository before relying on it.

1. Immediate mitigations:

• Restrict the api.users.write capability to a minimal set of trusted super-admin accounts; remove it from delegated user-manager roles until the plugin is confirmed patched.
• Limit network exposure of the Grav admin UI and API to trusted management networks or a VPN, and enforce strong authentication (MFA via a reverse proxy if available).
• Audit existing account access maps and invitations for unexpected positive scalar admin or api parent grants and revoke any unauthorized changes.
• Monitor and alert on writes to user access maps and invitations as defined in the detection rules above.

2. Patch/upgrade steps:

• Upgrade grav-plugin-api to 1.0.36 or later after verifying the release through the official Grav project channels.
• Back up user/account configuration before upgrading and re-audit permissions after the upgrade.
• Rotate credentials of any delegated accounts that held api.users.write if compromise is suspected.

3. Long-term hardening:

• Apply least privilege to all administrative roles; avoid granting user-management write capabilities to non-super-admin accounts.
• Adopt configuration-as-code (e.g., version-controlled blueprints) for user and permission changes so unauthorized edits are visible in diffs.
• Track Grav core and plugin advisories and subscribe to CVE feeds for prompt patching of permission-logic defects.

References

• NVD — CVE-2026-109317: https://nvd.nist.gov/vuln/detail/CVE-2026-109317
• CWE-269 — Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• Grav CMS project — plugin repository and release notes for grav-plugin-api
• CISA Known Exploited Vulnerabilities catalog (not listed for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-109317 at the time of writing; no public PoC, exploit code, or Nuclei template is available, and EPSS has not yet scored the vulnerability.