CVE-2026-72833
Received Received - Intake

Privilege Escalation in Grav API Plugin

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin()-gated write endpoints (in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController). These endpoints authorize via a super-admin early-return that never invokes requirePermission()—the sole enforcement point of the scope cap—so a 'read-only'-scoped key (e.g. api.pages.read) can perform super-only write operations, including rewriting group ACL maps to grant super-admin privileges to arbitrary accounts. A leaked or delegated read-only CI/monitoring key can therefore gain full super-admin write capability. Fixed in 1.0.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72833
EUVD
EUVD-2026-58647

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
getgrav grav-plugin-api From 1.0.6 (inc) to 1.0.11 (inc)
getgrav grav_plugin_api From 1.0.6 (inc) to 1.0.11 (inc)
getgrav grav_plugin_api 1.0.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72833 is a privilege escalation flaw in the Grav API plugin versions 1.0.6 to 1.0.11. It allows a scoped API key created on a super-admin account to bypass its intended permissions. The vulnerability affects four endpoints in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController. These endpoints incorrectly authorize actions using a super-admin check that skips scope enforcement, letting a read-only key perform super-admin write operations like modifying group ACLs to grant super-admin privileges to other accounts.

Detection Guidance

Check Grav plugin versions with: composer show getgrav/grav-plugin-api. If version is between 1.0.6 and 1.0.11, the system is vulnerable. Inspect API keys for super-admin scopes or unexpected permissions. Review logs for unauthorized access to GroupsController, AccountsConfigController, PreferencesController, or DashboardWidgetController endpoints.

Impact Analysis

If you use Grav CMS with the affected API plugin versions, an attacker with access to a leaked or delegated read-only API key could escalate privileges. This could allow unauthorized super-admin access, configuration changes, file uploads, or rewriting group permissions to grant super-admin rights to arbitrary accounts. The impact includes full system compromise depending on the key's scope.

Compliance Impact

This vulnerability could lead to unauthorized access and privilege escalation, violating data protection requirements under GDPR and HIPAA. Unauthorized super-admin access risks exposing sensitive data, altering configurations, or granting excessive permissions, all of which could result in compliance violations, data breaches, and regulatory penalties.

Mitigation Strategies

Upgrade Grav API plugin to version 1.0.13 or later immediately. Revoke all existing API keys and generate new ones with minimal required scopes. Audit group ACLs for unauthorized super-admin grants. Monitor endpoints mentioned for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72833. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart