API Scope Bypass in Grav API Plugin

Executive Summary

CVE-2026-72829 is an API-key scope bypass in the Grav API plugin before version 1.0.13. It allows an attacker with a limited api.users.write-scoped API key to bypass scope restrictions and grant super-admin privileges. The vulnerability exists because the create() and update() methods only enforce scope caps for api.users.write but permit super-privilege grants through a direct isSuperAdmin() check without consulting the key's scopes.

Useful 0 Not Useful 0

Detection Guidance

Check Grav plugin version with: composer show getgrav/grav-plugin-api. If version is less than 1.0.13, the system is vulnerable. Inspect UsersController.php for improper scope validation in create() and update() methods.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to escalate privileges from a limited API key to full super-admin access. They could mint or promote another super account, then authenticate as that account to gain unrestricted administrative control over the Grav CMS. This could lead to data theft, system compromise, or further attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Update the grav-plugin-api to version 1.0.13 or later immediately. Review API keys with api.users.write scope on super accounts and revoke unnecessary privileges. Monitor for unauthorized super account creation or privilege changes.

Useful 0 Not Useful 0