CVE-2026-72823
Received Received - Intake

API Key Scope Bypass in Grav API Plugin

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks isSuperAdmin() and returns early before invoking requirePermission(), so the api_key_scopes cap (enforced only in requirePermission()) is skipped. As a result, any scoped API key minted on a super account can bypass its scope restrictions when calling the baseline() and reset() operations (e.g. POST /api/v1/demo/reset), allowing it to capture the demo baseline or force a demo reset. Impact is bounded to demo-engine control and is conditional on demo mode being configured with writable resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72823
EUVD
EUVD-2026-58637

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-api to 1.0.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72823 is an API-key scope bypass in the Grav API plugin (grav-plugin-api) versions before 1.0.13. The DemoController's private requireSuper() method checks isSuperAdmin() first and returns early, skipping the api_key_scopes cap enforced in requirePermission(). This allows scoped API keys on super accounts to bypass restrictions and perform unauthorized actions like capturing demo baselines or forcing demo resets via endpoints such as POST /api/v1/demo/reset.

Detection Guidance

Check Grav CMS plugin versions for grav-plugin-api <= 1.0.12. Inspect DemoController.php for the requireSuper() method override. Monitor API logs for unauthorized POST requests to /api/v1/demo/reset or similar endpoints.

Impact Analysis

This vulnerability allows unauthorized users with scoped API keys on super accounts to capture demo baselines or force demo resets in Grav CMS. Impact is limited to demo-engine control and requires demo mode to be configured with writable resources. The attacker must have a super admin account with a scoped API key to exploit this issue.

Mitigation Strategies

Upgrade grav-plugin-api to version 1.0.13 or later. Remove the requireSuper() method override in DemoController.php. Restrict API key scopes and disable demo mode if not needed. Review and audit API key permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72823. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart