Grav API Plugin Authentication Bypass via Group-Inherited Super

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps getgrav/grav-plugin-api (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for getgrav/grav-plugin-api.
2. 2Review the reported fix. Update getgrav/grav-plugin-api to 1.0.20 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 5, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 5, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 5, 2026

Sources and claim methodology

• GitHub security advisorygithub.com
• Source referencevulncheck.com

Related CVEs

• grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super FlagSame getgrav/grav-plugin-api package
• Grav API Plugin before 1.0.20 Authentication Bypass via Host HeaderSame getgrav/grav-plugin-api package
• Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook InjectionSame generic ecosystem
• ugrep before 7.6.0 Heap Buffer Over-read via .Z decompressionSame generic ecosystem
• CDT before 1.4.5 Out-of-Bounds Read via opposedVertexIndSame generic ecosystem
• Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account TakeoverSame generic ecosystem