CVE-2026-72824

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

CVE-2026-72825

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...

CVE-2026-72822

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...

CVE-2026-72826

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

CVE-2026-72833

The Grav API plugin getgrav/grav-plugin-api versions = 1.0.6 and = 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin-gated write endpoints in GroupsController, AccountsConfigController,...

CVE-2026-72833 Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys

The Grav API plugin getgrav/grav-plugin-api versions = 1.0.6 and = 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin-gated write endpoints in GroupsController, AccountsConfigController,...

CVE-2026-72829

CVE-2026-72829 is an API-key scope-cap bypass in the Grav API plugin (getgrav/grav-plugin-api) prior to 1.0.13 . The UsersController's create() and update() methods enforce scope caps only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.su...

CVE-2026-72828

Grav Plugin API before 1.0.13 (grav-plugin-api) is affected by CVE-2026-72828: InvitationsController fails to enforce API-key scope caps. strip-super and accept-groups checks rely on isSuperAdmin() instead of scope-aware permissions, allowing a least-privilege API key scoped to api.users.write (i...

EUVD-2026-58642

Grav Plugin API getgrav/grav-plugin-api before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin check rather than a scope-aware permission check, so a least-privilege API key scoped to api.users.write...

CVE-2026-72828

Grav Plugin API getgrav/grav-plugin-api before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin check rather than a scope-aware permission check, so a least-privilege API key scoped to api.users.write...

EUVD-2026-58640

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

CVE-2026-72826

getgrav/grav-plugin-api before 1.0.13 is vulnerable to a scope bypass in the createApiKey() function. The function fails to validate that a newly created API key's scopes are a subset of the caller's scopes. Because the self-target path of requireApiKeyPermission() only requires the baseline api....

CVE-2026-72826 Grav before 1.0.13 Scope Bypass via createApiKey

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

CVE-2026-72826 Grav before 1.0.13 Scope Bypass via createApiKey

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

CVE-2026-72826

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

CVE-2026-72825

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...

EUVD-2026-58639

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...

CVE-2026-72825

The CVE affects getgrav/grav-plugin-api prior to 1.0.13. The ReportsController POST /reports/twig-content/allowlist enforces api.config.write then uses a bare isSuperAdmin() check instead of requireSuper(), causing an API key with scoped access to api.config.write minted on a super account to byp...

EUVD-2026-58638

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

CVE-2026-72824

CVE-2026-72824 affects the Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 . The root cause is an API key scope-cap bypass in PagesController::guardTwigContent(): the Twig-toggle check relies on a bare isSuperAdmin() gate without consulting api_key_scopes. A least-privilege API key scoped...