CVE-2026-72826: Grav API Plugin before 1.0.13 Scope Bypass via createApiKey

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-14 · updated 2026-10-29
Weakness: CWE-266

Description

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super account can submit an empty scopes array to mint an unscoped, full-access super key, bypassing scope restrictions (and enabling further chains such as configuration write to RCE).

Affected products

getgrav grav-plugin-api: before 1.0.13 — fixed in 1.0.13

How to fix

Upgrade to a fixed version: getgrav grav-plugin-api 1.0.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-72826 or the next vulnerability affects your stack