Vulnerability · Published Aug 14, 2026 · Assigned by VulnCheck

CVE-2026-72833Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys

High 8.8

In plain English

A high-severity privilege mismanagement in grav-plugin-api from getgrav. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 59.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin()-gated write endpoints (in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController). These endpoints authorize via a super-admin early-return that never invokes requirePermission()—the sole enforcement point of the scope cap—so a 'read-only'-scoped key (e.g. api.pages.read) can perform super-only write operations, including rewriting group ACL maps to grant super-admin privileges to arbitrary accounts. A leaked or delegated read-only CI/monitoring key can therefore gain full super-admin write capability. Fixed in 1.0.13.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav-plugin-api	1.0.6 – through 1.0.11

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-jqgq-v53x-x99g) vendor-advisory
VulnCheck Advisory: Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys third-party-advisory