CVE-2026-65897
Received Received - Intake

Grav API Plugin Privilege Escalation via Group Assignment

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65897
EUVD
EUVD-2026-48247

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
getgrav grav-api-plugin to 1.0.10 (exc)
getgrav grav-plugin-api to 1.0.9 (inc)
grav api_plugin to 1.0.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Grav API Plugin versions before 1.0.10 allows authenticated users with api.users.write permissions to assign invited accounts to groups that grant super-admin privileges. The InvitationsController::create() function fails to validate the groups field, enabling attackers to create invitation records with elevated group membership. When accepted, the new account gains full super-admin API access without the inviter having those permissions.

Detection Guidance

Check Grav API Plugin version with: grep -r 'api_plugin' /path/to/grav/installation. Versions before 1.0.10 are vulnerable. Review API logs for suspicious invitation records with elevated group assignments.

Impact Analysis

An attacker with basic user-management permissions could escalate their access to full super-admin capabilities. This could lead to complete system compromise, unauthorized data access, or control over the Grav CMS environment. The impact includes potential data breaches, loss of system integrity, and unauthorized administrative actions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using affected Grav API Plugin versions may face compliance violations, regulatory fines, and reputational damage due to potential data breaches or unauthorized system access.

Mitigation Strategies

Upgrade Grav API Plugin to version 1.0.10 or later immediately. Review all user accounts created via invitations for unauthorized super-admin assignments. Temporarily restrict api.users.write permissions until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65897. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart