CVE-2026-72833

Name of the Vulnerable Software and Affected Versions Grav API plugin (getgrav/grav-plugin-api) versions 1.0.6 through 1.0.11

Description A privilege escalation issue exists where a scoped API key created from a super-admin account can bypass its defined scope restrictions. This occurs because four write endpoints within GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController use an isSuperAdmin() check that returns early without calling requirePermission(), which is the only mechanism that enforces scope limits. Consequently, a key with read-only permissions, such as api.pages.read, can execute administrative write operations, including the modification of group Access Control Lists (ACL) to grant super-admin privileges to any account.

Recommendations Update Grav API plugin (getgrav/grav-plugin-api) to version 1.0.13.