Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so a least-privilege API key (scoped to api.users.write) minted on a super account can create an invitation record containing super-admin access flags. When the invitation is accepted, those flags are written verbatim to the new account, resulting in privilege escalation to a fully controlled super account.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Getgrav |
|
No data.
No data.
No data.
References
History
Fri, 14 Aug 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so a least-privilege API key (scoped to api.users.write) minted on a super account can create an invitation record containing super-admin access flags. When the invitation is accepted, those flags are written verbatim to the new account, resulting in privilege escalation to a fully controlled super account. | |
| Title | Grav before 1.0.13 API Key Scope Bypass via InvitationsController | |
| First Time appeared |
Getgrav
Getgrav grav |
|
| Weaknesses | CWE-269 | |
| CPEs | cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Getgrav
Getgrav grav |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-08-14T11:35:35.810Z
Reserved: 2026-08-10T15:12:59.509Z
Link: CVE-2026-72828
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-14T12:16:46.030
Modified: 2026-08-14T12:16:46.030
Link: CVE-2026-72828
Redhat
No data.
OpenCVE Enrichment
No data.