CVE-2026-72826
Received Received - Intake

API Key Scope Bypass in Grav CMS Plugin

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super account can submit an empty scopes array to mint an unscoped, full-access super key, bypassing scope restrictions (and enabling further chains such as configuration write to RCE).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72826
EUVD
EUVD-2026-58640

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav to 1.0.13 (exc)
getgrav grav-plugin-api to 1.0.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a scope bypass issue in the Grav CMS plugin grav-plugin-api before version 1.0.13. It allows an attacker with a minimal API key to create a new API key with full access by submitting an empty scopes array. The plugin fails to validate that the new key's scopes are a subset of the caller's scopes, bypassing intended restrictions.

Detection Guidance

Check Grav CMS versions and the grav-plugin-api plugin version. Use commands like 'composer show getgrav/grav-plugin-api' or inspect the plugin directory for version files. Look for API key creation logs or unusual key generation requests with empty scopes.

Impact Analysis

An attacker exploiting this could escalate privileges from a minimal API key to a full-access super key. This could lead to unauthorized configuration changes, remote code execution, or further compromise of the Grav CMS system. The impact includes complete control over the affected application.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules. It undermines access controls and could result in non-compliance with these regulations due to potential exposure of sensitive data.

Mitigation Strategies

Upgrade the grav-plugin-api plugin to version 1.0.13 or later immediately. Review all API keys for unscoped or full-access keys created by users with minimal scopes. Revoke suspicious keys and enforce scope validation checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72826. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart