CVE-2026-109317 Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...