CVE-2026-72828

Name of the Vulnerable Software and Affected Versions Grav Plugin API (getgrav/grav-plugin-api) versions prior to 1.0.13

Description An issue exists in the InvitationsController where API-key scope caps are not properly enforced. The system uses a basic isSuperAdmin() check instead of a scope-aware permission check for strip-super and accept-groups decisions. Consequently, an API key with limited privileges (scoped to api.users.write) created from a super account can generate an invitation record that includes super-admin access flags. Once the invitation is accepted, these flags are applied to the new account, leading to privilege escalation to a super account.

Recommendations Update Grav Plugin API (getgrav/grav-plugin-api) to version 1.0.13 or later.