API-Key Scope Bypass Vulnerability in Grav API Plugin by Getgrav

CVE-2026-72823

What is CVE-2026-72823?

The Grav API plugin prior to version 1.0.13 has a flaw in the DemoController that allows an API-key scope cap bypass. Specifically, the private method requireSuper() checks for super admin status but does not enforce scope restrictions effectively. Consequently, scoped API keys issued to super accounts can bypass permissions when executing certain operations, including baseline retrieval and demo resets. This situation potentially exposes demo environment controls to unauthorized actions, particularly if demo mode is set up with writable resources.

References