CVE-2026-72828 Grav before 1.0.13 API Key Scope Bypass via InvitationsController
A least-privilege API key can create invitations with super-admin flags, allowing attackers to escalate privileges to a fully controlled super account.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72828?
CVE-2026-72828 is a high-severity vulnerability in getgrav grav, published on 14 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so a least-privilege API key (scoped to api.users.write) minted on a super account can create an invitation record containing super-admin access flags. When the invitation is accepted, those flags are written verbatim to the new account, resulting in privilege escalation to a fully controlled super account.
Weakness: CWE-269
Which versions are affected by CVE-2026-72828?
How do I fix CVE-2026-72828?
No fix has been published for CVE-2026-72828 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-72828 being exploited?
There is no known exploitation of CVE-2026-72828 in the wild and no public exploit code.
Sources
Also known as GHSA-g77x-8h46-q78g.