Vulnerability · Published Aug 14, 2026 · Assigned by VulnCheck

CVE-2026-72829Grav before 1.0.13 API Key Scope Bypass via UsersController

High 8.8

In plain English

A high-severity privilege mismanagement in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 59.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a result, an api.users.write-scoped key minted on a super account can set access.api.super or assign a super-granting group to mint or promote a full super account, then authenticate as that account for uncapped administrative privileges.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	0 – before 1.0.13

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-jrm3-jpp7-3gmx) vendor-advisory
VulnCheck Advisory: Grav before 1.0.13 API Key Scope Bypass via UsersController third-party-advisory