CVE-2026-72829

creationtimestamp| type| source ---|---|--- 2026-08-14 12:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt26jf2baq25 2026-08-14 13:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/117094103522465305 2026-08-14 13:30:28+00:00| seen|...

CVE-2026-72829 Grav before 1.0.13 API Key Scope Bypass via UsersController

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

CVE-2026-72829

CVE-2026-72829 affects Grav plugin Grav API API-key scope bypass in UsersController create()/update() for getgrav/grav-plugin-api ≤ 1.0.12. The code enforces scope caps only for api.users.write, but uses a bare isSuperAdmin() check reading access.api.super, bypassing key scopes. This allows an ap...