CVE-2026-42844

HighCVSS 8.8

Published: 12/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

Grav is a file-based web platform. In version 2.0.0-beta.2, a low-privileged authenticated API user can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges, resulting in full administrative compromise of the Grav API.

Risk Assessment

The organization may face serious security implications, including unauthorized access to data and system resources.

Recommendation

It is recommended to upgrade to API version 1.0.0-beta.17 to mitigate this vulnerability.

Other vulnerabilities in Grav API

CVE-2026-109320Medium
The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.

Original NVD description (English source)

Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS