PT-2026-71999
CVE-2026-72830
·
Published
2026-08-14
·
Updated
2026-08-24
Description by
CVSS 3.1
8.8
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Grav API plugin versions prior to 1.0.13
Description
Failure to enforce API key scope caps in
ConfigController super-scope gates allows scoped keys to modify scheduler configuration. An attacker possessing a scoped api.config.write key can inject arbitrary commands into scheduler.custom jobs, which are then executed via Symfony Process, leading to remote code execution.Recommendations
Update Grav API plugin to version 1.0.13 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾