CVE-2026-72823

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.13

Description A scope cap bypass exists in the DemoController of the Grav API plugin. The private requireSuper() function checks isSuperAdmin() and returns early, skipping the requirePermission() function where the api key scopes restriction is enforced. Consequently, a scoped API key created from a super account can bypass its restrictions when accessing the baseline() and reset() operations, such as the 'POST /api/v1/demo/reset' endpoint. This allows an attacker to capture the demo baseline or force a demo reset, provided that demo mode is configured with writable resources.

Recommendations Update Grav API plugin to version 1.0.13 or later.