What’s Vulnerable › Vulnerabilities

CVE-2026-65897: Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-23 · updated 2026-10-24
• Weakness: CWE-269

Description

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.

Affected products

• getgrav grav: before 1.0.10 — fixed in 1.0.10

How to fix

Upgrade to a fixed version: getgrav grav 1.0.10. Check the vendor advisory for mitigations.

References

• https://github.com/getgrav/grav-plugin-api/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd
• https://github.com/getgrav/grav/commit/345e79e3abf8c15f80e612a09f6643300071324b
• https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv
• https://www.vulncheck.com/advisories/grav-api-plugin-privilege-escalation-via-invitations-groups
• https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv

Get alerted when CVE-2026-65897 or the next vulnerability affects your stack