{"metadata": {"vulnerability": "cve-2026-109317", "count": 15, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-23T00:00:00Z", "date_only": false, "value": "2026-09-23T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109317", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T14:15:29.011Z", "date_only": false, "value": "2026-10-12T14:15:29.011Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-109317", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T16:05:10.826Z", "date_only": false, "value": "2026-10-12T16:05:10.826Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-109317", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T16:05:10.826Z", "date_only": false, "value": "2026-10-12T16:05:10.826Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109317", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T17:17:26Z", "date_only": false, "value": "2026-10-12T17:17:26Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7GHM-8Q85-6H4J", "record": "GHSA-7GHM-8Q85-6H4J", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T17:17:26.653Z", "date_only": false, "value": "2026-10-12T17:17:26.653", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109317", "record": "FKIE_CVE-2026-109317", "field": "published"}, {"timestamp": "2026-10-12T17:20:38.319Z", "date_only": false, "value": "2026-10-12T17:20:38.319392Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117429084965329059", "record": "CVE-2026-109317", "field": "creation_timestamp", "uuid": "855f39bf-7a04-4384-8486-6a14e71f8031", "content": "CVE-2026-109317 Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109317https://github.com/getgrav/grav/security/advisories/GHSA-m2rq-76vx-vv4jhttps://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.36-privilege-escalation-via-scalar-access-grants#getgrav #grav-plugin-api#CVE_2026_109317#bot", "url": "https://infosec.exchange/users/cve/statuses/117429084965329059"}, {"timestamp": "2026-10-12T18:31:48Z", "date_only": false, "value": "2026-10-12T18:31:48Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7GHM-8Q85-6H4J", "record": "GHSA-7GHM-8Q85-6H4J", "field": "published"}, {"timestamp": "2026-10-12T18:31:48Z", "date_only": false, "value": "2026-10-12T18:31:48Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7GHM-8Q85-6H4J", "record": "GHSA-7GHM-8Q85-6H4J", "field": "modified"}, {"timestamp": "2026-10-13T04:50:05.815Z", "date_only": false, "value": "2026-10-13T04:50:05.815971Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxqaa6db2k22", "record": "CVE-2026-109317", "field": "creation_timestamp", "uuid": "bcea8238-b935-44e5-bcc2-6c653ef44047", "content": "CVE-2026-109317\nThe Grav plugin API (versions before 1.0.36) lets a user who can manage other users edit permission settings to trick the system into thinking they are a super\u2011admin. This can give them access to functions\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxqaa6db2k22"}, {"timestamp": "2026-10-15T02:44:23.135Z", "date_only": false, "value": "2026-10-15T02:44:23.135089Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-109317", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T02:44:23.135Z", "date_only": false, "value": "2026-10-15T02:44:23.135089Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109317", "record": "FKIE_CVE-2026-109317", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T02:44:33.219Z", "date_only": false, "value": "2026-10-15T02:44:33.219Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-109317", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T02:44:33.219Z", "date_only": false, "value": "2026-10-15T02:44:33.219Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-109317", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T15:12:54.040Z", "date_only": false, "value": "2026-10-15T15:12:54.040", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109317", "record": "FKIE_CVE-2026-109317", "field": "lastModified"}]}