API Key Scope Bypass in Grav API Plugin by Grav

CVE-2026-72829

What is CVE-2026-72829?

The Grav API plugin prior to version 1.0.13 contains a vulnerability in the UsersController's create() and update() methods that allows an API key with write scope to bypass intended restrictions. Although it enforces access for the api.users.write scope, it does not adequately validate super-user privileges, allowing escalation of permissions through a direct check of the isSuperAdmin() function without considering the key's scopes. Consequently, this flaw can permit a malicious actor to create or promote a super account with uncapped administrative privileges, jeopardizing the security of the entire Grav environment.

References