A privilege-management flaw in the getgrav/grav-plugin-api plugin before 1.0.13 allows an attacker with a minimal-scope API key to create an unscoped, full-access key.
What Is It
CVE-2026-72826 is a CVSS 9.8 (CRITICAL) privilege management vulnerability (CWE-266) in the getgrav/grav-plugin-api plugin. The createApiKey function fails to validate that the scopes of a newly created API key are a subset of the caller's scopes. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check.
The result: an attacker holding a minimal-scope API key on a super account can submit an empty scopes array and mint an unscoped, full-access super key; bypassing scope restrictions entirely.
Why It Matters
The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity attack with high impact across confidentiality, integrity, and availability.
One caveat on that vector: PR:N (no privileges required) does not match the attack as described. Exploitation requires the attacker to already hold a valid, if minimal-scope, API key on a super account, which is a low-privilege precondition (PR:L), not an unauthenticated one. The scored severity is therefore likely inflated relative to the real prerequisite. This is a post-authentication privilege escalation, not an open door; treat exposure as a function of how widely narrow-scope keys have been issued.
The disclosure notes the bypass enables further chains such as configuration write to remote code execution. That turns a limited-scope credential, the kind issued for narrow automation tasks and treated as low-risk, into full control of the affected instance.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation at this time.
What's Vulnerable
- Vendor: getgrav
- Product: grav (
grav-plugin-api) - Affected: all versions before 1.0.13 (semver, default status: unaffected)
- Not affected: 1.0.13 and later
Patch Status
Version 1.0.13 is listed as unaffected. Upgrade grav-plugin-api to 1.0.13 or later. As a compensating step, audit existing API keys on super accounts and revoke any unscoped keys that cannot be accounted for. No CISA KEV due date or required action was supplied for this CVE.
The severity figures above come from the reporting source's advisory rather than independent analysis, so treat the scoring as provisional and weigh it against the low-privilege precondition described earlier.
Sources
- GitHub Security Advisory GHSA-95v9-4fcj-96gh; https://github.com/getgrav/grav/security/advisories/GHSA-95v9-4fcj-96gh
- VulnCheck Advisory: Grav scope bypass via createApiKey; https://www.vulncheck.com/advisories/grav-before-scope-bypass-via-createapikey