CVE-2026-72829 in Grav
Summary
by MITRE • 08/14/2026
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a result, an api.users.write-scoped key minted on a super account can set access.api.super or assign a super-granting group to mint or promote a full super account, then authenticate as that account for uncapped administrative privileges.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability in the Grav API plugin affects versions prior to 1.0.13 and represents a critical authorization bypass flaw that undermines the plugin's access control mechanisms. This issue stems from inconsistent privilege enforcement within the UsersController class where the create() and update() methods implement scope-based restrictions for api.users.write permissions but fail to apply equivalent checks when evaluating super-administrator privileges. The root cause lies in the direct evaluation of isSuperAdmin() status without verifying whether the API key possesses appropriate scope authorization, creating a dangerous gap in the authentication framework that allows malicious actors to escalate their privileges.
The technical implementation flaw manifests through improper scope validation where the system correctly enforces scope limitations for user management operations but completely bypasses these controls when processing super-administrator grants. This design oversight enables an attacker with an API key scoped to api.users.write to manipulate user accounts and grant themselves or others full administrative privileges by directly setting access.api.super flags or assigning super-granting group memberships. The vulnerability operates at the intersection of inadequate privilege validation and overly permissive access control checks, creating a pathway for unauthorized privilege escalation that violates fundamental security principles.
The operational impact of this vulnerability extends far beyond simple access control bypass as it enables complete administrative takeover of affected systems. An attacker with a valid api.users.write-scoped key can mint new super-administrator accounts or modify existing ones to grant unlimited privileges without restriction, effectively neutralizing all user management and access control protections established by the system. This capability allows for comprehensive system compromise including but not limited to data exfiltration, configuration changes, user account manipulation, and complete administrative control over the Grav CMS installation.
This vulnerability aligns with CWE-284 Access Control Issues and specifically demonstrates a privilege escalation pattern that maps to ATT&CK technique T1078 Valid Accounts. The flaw represents a classic case of insufficient authorization checks where the system fails to properly validate that API keys possess appropriate scope permissions before permitting operations that could result in privilege elevation. Organizations using affected versions of the Grav API plugin face significant risk as this vulnerability allows attackers to bypass established access control mechanisms without requiring additional credentials or exploiting other security flaws, making it particularly dangerous in environments where API keys are exposed or compromised.
Mitigation strategies should prioritize immediate patching to version 1.0.13 or later where the scope validation has been corrected to properly enforce authorization boundaries for all privilege-granting operations. System administrators should review and audit existing API key permissions to ensure that super-administrator access is not unnecessarily granted to keys with limited scope, implementing the principle of least privilege for all API access. Additionally, monitoring systems should be enhanced to detect unusual user account modifications or privilege escalation attempts that may indicate exploitation of this vulnerability. Regular security assessments of API endpoints and access control implementations should be conducted to identify similar authorization bypass patterns that could compromise system integrity and confidentiality.