CVE-2026-72828 in Grav
Summary
by MITRE • 08/14/2026
Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so a least-privilege API key (scoped to api.users.write) minted on a super account can create an invitation record containing super-admin access flags. When the invitation is accepted, those flags are written verbatim to the new account, resulting in privilege escalation to a fully controlled super account.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability resides within the Grav Plugin API version prior to 1.0.13 where the InvitationsController fails to properly enforce API key scope limitations. This represents a critical authorization flaw that directly violates the principle of least privilege and allows for unauthorized privilege escalation. The issue stems from improper access control validation mechanisms that rely solely on the isSuperAdmin() function rather than implementing scope-aware permission checks as mandated by security best practices.
The technical implementation flaw occurs in how the system processes invitation records created through API keys. When an API key with limited scope such as api.users.write is used to create an invitation, the system should validate that the requesting entity has sufficient permissions to grant super-admin privileges. However, the current implementation bypasses proper scope validation and directly accepts super-admin flags from invitation data without verifying whether the issuing API key possesses the necessary elevated permissions. This pattern aligns with CWE-284 access control flaws where improper authorization checks lead to privilege escalation vulnerabilities.
The operational impact of this vulnerability is severe as it allows attackers to escalate privileges from limited API key access to full administrative control over the Grav system. An attacker with a legitimate but restricted API key can create invitation records that contain super-admin flags, which are then applied verbatim when the invitation is accepted. This creates a backdoor mechanism for privilege escalation that bypasses normal user management controls and authentication processes.
This vulnerability directly maps to ATT&CK technique T1078 credential access and T1484 legitimate credentials, where attackers leverage existing valid credentials to gain elevated privileges through improper access control enforcement. The flaw essentially allows attackers to create a new administrative account with full super-admin capabilities using only a limited scope API key, representing a fundamental breakdown in the system's permission model.
The recommended mitigations include implementing proper scope validation within the InvitationsController that checks API key permissions against required privileges before allowing super-admin flag creation. Additionally, all invitation data should be validated against the issuing API key's scope before being applied to new user accounts. The system should enforce that only API keys with explicit super-admin scope can create invitations containing elevated privilege flags.
Organizations should immediately update to Grav Plugin API version 1.0.13 or later where this vulnerability has been patched. Furthermore, security teams should review existing API key permissions and implement stricter access controls around invitation creation processes. The solution must ensure that no user account can be created with elevated privileges without explicit authorization from an API key with matching scope. This fix aligns with security standards requiring proper input validation and privilege enforcement mechanisms to prevent unauthorized escalation of privileges.
The vulnerability demonstrates a classic case where insufficient authorization checks in API endpoints lead to dangerous privilege escalation scenarios. It highlights the importance of implementing comprehensive permission models that consider both user roles and API key scopes, ensuring that each operation within the system respects established security boundaries and maintains proper separation of privileges.