CVE-2026-72826

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.13

Description The getgrav/grav-plugin-api plugin fails to validate that the scopes of a newly created API key are a subset of the caller's scopes within the createApiKey() function. The self-target path of requireApiKeyPermission() only requires the baseline api.access scope, and the scopes for the new key are read directly from the request body without a subset check. This allows an attacker with a minimal-scope API key on a super account to submit an empty scopes array to create an unscoped, full-access super key, bypassing scope restrictions and potentially leading to remote code execution (RCE) via configuration write.

Recommendations Update getgrav/grav-plugin-api to version 1.0.13 or later.