CVE-2026-65897

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.10

Description Insufficient validation of the groups field within the InvitationsController::create() function allows authenticated users with api.users.write permissions to assign invited accounts to groups that grant api.super permissions. This enables an attacker to create invitation records with elevated group membership, granting the new account full super-admin API access regardless of the inviter's own permission level.

Recommendations Update Grav API Plugin to version 1.0.10 or later.