CVE-2026-72830 in Grav Plugin
Summary
by MITRE • 08/14/2026
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.custom_jobs that execute via Symfony Process for remote code execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability exists within the Grav API plugin ecosystem where versions prior to 1.0.13 contain a critical authorization flaw in the ConfigController component. This issue stems from insufficient enforcement of API key scope limitations, specifically within super-scope gates that should normally restrict access based on predefined permissions. The flaw allows malicious actors with a scoped API key possessing the config.write permission to bypass normal security boundaries and manipulate scheduler configuration parameters.
The technical implementation of this vulnerability leverages the improper handling of API key scopes within the super-scope validation mechanisms. When an attacker presents a scoped key with the config.write capability, the system fails to properly validate whether this scope should extend to scheduler configuration modifications. This misconfiguration creates an authorization bypass that enables the injection of arbitrary commands through the scheduler.custom_jobs parameter. The vulnerability is particularly dangerous because it exploits the legitimate Symfony Process component which executes these injected commands with elevated privileges, creating a direct path for remote code execution.
The operational impact of this vulnerability is severe and encompasses multiple attack vectors within the Grav CMS environment. An attacker who gains access to a scoped API key with config.write permissions can execute arbitrary shell commands on the affected server, potentially leading to complete system compromise. The vulnerability affects the core functionality of scheduler management, allowing attackers to modify automated job configurations that may include malicious payloads or backdoor installations. This creates persistent access opportunities and enables advanced persistent threat scenarios where attackers can maintain control over compromised systems.
The underlying flaw aligns with CWE-285, which addresses improper authorization within software applications, and demonstrates characteristics consistent with ATT&CK technique T1059 for command and scripting interpreter usage. The vulnerability exploits a lack of proper input validation and access control enforcement, creating an attack surface where scoped permissions are improperly enforced across different system components. Organizations running affected Grav API plugin versions face significant risk of unauthorized code execution, data exfiltration, and system compromise. Mitigation strategies should include immediate upgrade to version 1.0.13 or later, implementation of stricter API key scope enforcement, and monitoring for anomalous scheduler configuration changes.
Security controls should focus on strengthening authorization boundaries within the ConfigController component, implementing comprehensive input validation for all scheduler parameters, and establishing proper scope validation mechanisms that prevent cross-component privilege escalation. Organizations should also consider network segmentation to limit exposure of API endpoints, implement robust logging and monitoring of configuration changes, and conduct regular security assessments to identify similar authorization bypass vulnerabilities in other components. The fix addresses the core issue by properly enforcing API key scopes during super-scope gate validation, ensuring that scoped permissions cannot be leveraged to access functionality outside their intended boundaries.
This vulnerability demonstrates how seemingly minor authorization flaws can create significant security risks when combined with legitimate system components like Symfony Process. The attack chain requires only a valid scoped API key and knowledge of the scheduler configuration interface, making it accessible to attackers with basic privileges. Proper implementation of principle of least privilege and comprehensive scope validation would prevent this type of cross-component privilege escalation, ensuring that even if an attacker compromises a scoped key, they cannot leverage it to access other system components. Regular security testing and code review practices should specifically target authorization boundary enforcement to prevent similar issues in the future.