The Grav grav‑plugin‑api prior to 1.0.36 contains a flaw that permits a delegated user manager to gain super‑admin privileges by assigning positive scalar admin or api parent grants. By storing such grants, an attacker with api.users.write rights can modify account access maps or invitations so that the inheriting permission resolver satisfies requireSuper checks, thereby allowing access to API endpoints reserved for super‑only users.

Affected products include the Grav Plugin API from getgrav, versions earlier than 1.0.36. Customers deploying any of the vulnerable plugin releases should verify their installation and consider the version constraint.

The CVSS score of 8.6 indicates high severity. Although no EPSS score is published, the lack of a KEV listing suggests that current exploitation activity may be limited. Exploitation requires that an attacker already possesses api.users.write rights, allowing them to modify account access maps or invitations; once the permission resolver admits requireSuper checks, super‑only API endpoints become reachable.