The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin()-gated write endpoints (in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController). These endpoints authorize via a super-admin early-return that never invokes requirePermission()—the sole enforcement point of the scope cap—so a 'read-only'-scoped key (e.g. api.pages.read) can perform super-only write operations, including rewriting group ACL maps to grant super-admin privileges to arbitrary accounts. A leaked or delegated read-only CI/monitoring key can therefore gain full super-admin write capability. Fixed in 1.0.13.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 14 Aug 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin()-gated write endpoints (in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController). These endpoints authorize via a super-admin early-return that never invokes requirePermission()—the sole enforcement point of the scope cap—so a 'read-only'-scoped key (e.g. api.pages.read) can perform super-only write operations, including rewriting group ACL maps to grant super-admin privileges to arbitrary accounts. A leaked or delegated read-only CI/monitoring key can therefore gain full super-admin write capability. Fixed in 1.0.13. | |
| Title | Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys | |
| First Time appeared |
Getgrav
Getgrav grav |
|
| Weaknesses | CWE-269 | |
| CPEs | cpe:2.3:a:getgrav:grav:1.0.6:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.7.53.1:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.7.53.2:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.7.53:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.0:-:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.0:rc10:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.0:rc6:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.0:rc7:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.0:rc8:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.0:rc9:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.10:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.1:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.2:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.3:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.4:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.5:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.6:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.7:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.8:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.9:*:*:*:*:*:*:* |
|
| Vendors & Products |
Getgrav
Getgrav grav |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-08-14T11:35:39.243Z
Reserved: 2026-08-10T15:13:41.486Z
Link: CVE-2026-72833
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses