A privilege-management flaw in the Grav API plugin lets holders of a limited, scoped API key escalate to arbitrary command execution on the host via the scheduler configuration.
What Is It
CVE-2026-72830 is a critical (CVSS 3.1 base score 9.8, CVSS 4.0 base score 9.3) improper privilege management vulnerability, CWE-269, in the Grav API plugin. In versions before 1.0.13, the plugin fails to enforce API key scope caps in the ConfigController super-scope gates. That gap allows scoped keys to write scheduler configuration, which they should not be permitted to touch.
The exploitation path is direct: an attacker holding a scoped api.config.write key can inject arbitrary commands into scheduler.custom_jobs. Those injected commands are then executed via Symfony Process, yielding remote code execution.
Why It Matters
The published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low attack complexity, no user interaction, with high impact to confidentiality, integrity, and availability. Note that the PR:N metric (no privileges required) is inconsistent with the described exploitation path, which presupposes possession of a valid scoped api.config.write key; a vector reflecting that prerequisite would score privileges as required. Defenders should treat the attack as gated on holding an issued API key rather than as fully unauthenticated, and weigh the 9.8 base score accordingly.
The core failure is a trust boundary that does not hold: scoped keys are issued precisely so that they can be handed out with limited authority, and this flaw makes that limitation cosmetic. Any key issued for narrow configuration writes is effectively a full command execution primitive on the underlying host.
There is no CISA KEV entry supplied for this CVE, so active exploitation is not confirmed in the source material. The CVSS 4.0 exploit maturity is listed as NOT_DEFINED.
What's Vulnerable
- Vendor: getgrav
- Product: Grav (API plugin)
- Affected versions: all versions before 1.0.13 (semver)
- Unaffected: 1.0.13 and later
No CPE entries were published with this record.
Patch Status
Version 1.0.13 is designated unaffected and is the fixed release. Operators running the Grav API plugin should upgrade to 1.0.13 or later. Where immediate upgrade is not possible, treat every issued scoped API key as equivalent to host-level command execution: rotate or revoke keys that do not require configuration write access, and audit scheduler.custom_jobs for unexpected entries.
Sources
- GitHub Security Advisory GHSA-2x29-3mjq-2pvx (getgrav/grav), https://github.com/getgrav/grav/security/advisories/GHSA-2x29-3mjq-2pvx
- VulnCheck Advisory: Grav API Plugin Before, RCE via ConfigController Scope Bypass, https://www.vulncheck.com/advisories/grav-api-plugin-before-rce-via-configcontroller-scope-bypass