A privilege-management flaw in the Grav API plugin before 1.0.13 lets an api.users.write-scoped API key create or promote a full super-admin account, escaping the scope cap entirely.
What Is It
CVE-2026-72829 is an API-key scope-cap bypass (CWE-269, Improper Privilege Management) in the Grav API plugin (getgrav/grav-plugin-api). The create() and update() methods in UsersController enforce the scope cap only for api.users.write. Super-privilege grants, however, are gated on a bare isSuperAdmin() check that reads access.api.super directly without consulting the calling key's scopes.
The result: a key minted on a super account but limited to api.users.write can set access.api.super on a user, or assign a group that grants super privileges. The attacker then authenticates as that newly minted or promoted account and operates with uncapped administrative privileges.
Why It Matters
The issue carries a CVSS 3.1 base score of 9.8 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS 4.0 secondary score of 9.3 (CRITICAL) is also assigned. Note that the published PR:N metric does not match the described attack path: exploitation is not unauthenticated. The attacker must already hold a valid API key carrying the api.users.write scope, which is a privileged credential in Grav's model even though it is a deliberately limited one. Read the score as the severity of what a low-scoped key can reach, not as a measure of pre-authentication exposure.
What the vector does capture accurately is that the request is network-reachable and low-complexity, with high impact to confidentiality, integrity, and availability once that scoped key is in hand.
Practically, this collapses the security boundary the scope system exists to enforce. Any deployment that hands out narrowly-scoped API keys on the assumption that scope limits contain a compromised key is wrong about that assumption; a leaked or misused api.users.write key is equivalent to full site takeover.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation at this time.
What's Vulnerable
- Vendor/Product: getgrav; Grav (API plugin,
getgrav/grav-plugin-api) - Affected: all versions before 1.0.13
- Fixed: 1.0.13 and later (marked unaffected)
No CPE entries were published in the NVD record.
Patch Status
Upgrade the Grav API plugin to 1.0.13 or later. No mitigations, workarounds, or KEV-mandated remediation deadlines were included in the supplied source material. The record was published 2026-08-14 and remains in Received status, so NVD analysis is not yet complete; the scoring discrepancy noted above may be corrected during that analysis.
Until the upgrade lands, treat every outstanding api.users.write key as a potential super-admin credential: audit issued keys, revoke any that are unaccounted for, and review user records for unexpected access.api.super grants or group memberships that confer them.