CVE-2026-72823 Grav before 1.0.13 API-key scope cap bypass via DemoController

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...

EUVD-2026-58637

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...

CVE-2026-72823

The Grav API plugin (getgrav/grav-plugin-api) prior to 1.0.13 is impacted. Its DemoController contains a private requireSuper() check for isSuperAdmin() that returns early and skips requirePermission(), bypassing the api_key_scopes enforcement. Consequently, a scoped API key minted on a super acc...

CVE-2026-72823

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...

CVE-2026-72822

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...

CVE-2026-72822 Grav before 1.0.13 Authentication Bypass via disable2fa

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...

CVE-2026-72822

The getgrav/grav-plugin-api Composer package (versions ≤ 1.0.12) contains an authentication bypass on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermis...

EUVD-2026-58636

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...

CVE-2026-72822 Grav before 1.0.13 Authentication Bypass via disable2fa

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...

PT-2026-72068

An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope...

PT-2026-71991

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.13 Description The software fails to enforce API key scope caps on the disable2fa endpoint. While the generate2fa endpoint correctly applies these caps, disable2fa authorizes the admin path using...

PT-2026-71997

Name of the Vulnerable Software and Affected Versions Grav Plugin API getgrav/grav-plugin-api versions prior to 1.0.13 Description An issue exists in the InvitationsController where API-key scope caps are not properly enforced. The system uses a basic isSuperAdmin check instead of a scope-aware...

PT-2026-71999

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.13 Description Failure to enforce API key scope caps in ConfigController super-scope gates allows scoped keys to modify scheduler configuration. An attacker possessing a scoped api.config.write key can...

CVE-2026-72824: Missing Authorization

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

PT-2026-71993

Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.13 Description An API key scope-cap bypass exists in the guardTwigContent function within PagesController. The issue occurs because the Twig-toggle check relies on a basic...

PT-2026-71998

Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.13 Description An API-key scope-cap bypass exists in the create and update methods of the UsersController. While these methods enforce scope caps for api.users.write, they rely on a...

PT-2026-71992

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.13 Description A scope cap bypass exists in the DemoController of the Grav API plugin. The private requireSuper function checks isSuperAdmin and returns early, skipping the requirePermission function where...

PT-2026-71995

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.13 Description The getgrav/grav-plugin-api plugin fails to validate that the scopes of a newly created API key are a subset of the caller's scopes within the createApiKey function. The self-target...

CVE-2026-72837: Improper Access Control

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

CVE-2026-72829: Improper Privilege Management

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...