CVE-2026-72828
Received Received - Intake

Grav Plugin API Privilege Escalation via API Key Scope Bypass

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so a least-privilege API key (scoped to api.users.write) minted on a super account can create an invitation record containing super-admin access flags. When the invitation is accepted, those flags are written verbatim to the new account, resulting in privilege escalation to a fully controlled super account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72828
EUVD
EUVD-2026-58642

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav From 0 (inc) to 1.0.13 (exc)
getgrav grav-plugin-api to 1.0.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72828 is a privilege escalation flaw in Grav Plugin API versions before 1.0.13. It allows an attacker with a least-privilege API key (scoped to api.users.write) on a super account to create an invitation record with super-admin access flags. When accepted, this grants the new account full super-admin privileges.

Detection Guidance

Check Grav Plugin API version with: composer show getgrav/grav-plugin-api. If version is less than 1.0.13, the system is vulnerable. Inspect InvitationsController.php for improper isSuperAdmin() checks without scope validation.

Impact Analysis

An attacker could exploit this to create a fully privileged super-admin account, gaining complete control over the Grav CMS instance. This could lead to unauthorized data access, modification, or deletion, and potential compromise of all user accounts and system functions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, and failure to maintain proper access controls.

Mitigation Strategies

Upgrade grav-plugin-api to version 1.0.13 or later immediately. Review all API keys for super-admin accounts and restrict scopes. Monitor for unauthorized account creation or privilege escalation events.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72828. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart