EUVD-2026-58644

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...

CVE-2026-72829

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

CVE-2026-72829 Grav before 1.0.13 API Key Scope Bypass via UsersController

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

CVE-2026-72829 Grav before 1.0.13 API Key Scope Bypass via UsersController

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

EUVD-2026-58643

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

CVE-2026-72829

CVE-2026-72829 is an API-key scope-cap bypass in the Grav API plugin (getgrav/grav-plugin-api) prior to 1.0.13 . The UsersController's create() and update() methods enforce scope caps only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.su...

CVE-2026-72828

Grav Plugin API before 1.0.13 (grav-plugin-api) is affected by CVE-2026-72828: InvitationsController fails to enforce API-key scope caps. strip-super and accept-groups checks rely on isSuperAdmin() instead of scope-aware permissions, allowing a least-privilege API key scoped to api.users.write (i...

EUVD-2026-58642

Grav Plugin API getgrav/grav-plugin-api before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin check rather than a scope-aware permission check, so a least-privilege API key scoped to api.users.write...

CVE-2026-72826

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

EUVD-2026-58640

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

EUVD-2026-58638

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

CVE-2026-72825

The CVE affects getgrav/grav-plugin-api prior to 1.0.13. The ReportsController POST /reports/twig-content/allowlist enforces api.config.write then uses a bare isSuperAdmin() check instead of requireSuper(), causing an API key with scoped access to api.config.write minted on a super account to byp...

CVE-2026-72825

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...

EUVD-2026-58637

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...

CVE-2026-72823

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...

PT-2026-72000

Name of the Vulnerable Software and Affected Versions Flex Objects versions 1.0.0 through 1.4.6 Description An incorrect authorization issue exists in the Flex Objects API. The FlexApiController::update function only verifies general Flex directory permissions and fails to apply the target, field...

PT-2026-71997

Name of the Vulnerable Software and Affected Versions Grav Plugin API getgrav/grav-plugin-api versions prior to 1.0.13 Description An issue exists in the InvitationsController where API-key scope caps are not properly enforced. The system uses a basic isSuperAdmin check instead of a scope-aware...

PT-2026-71998

Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.13 Description An API-key scope-cap bypass exists in the create and update methods of the UsersController. While these methods enforce scope caps for api.users.write, they rely on a...

PT-2026-72002

Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions 1.0.6 through 1.0.11 Description A privilege escalation issue exists where a scoped API key created from a super-admin account can bypass its defined scope restrictions. This occurs because four...

PT-2026-71992

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.13 Description A scope cap bypass exists in the DemoController of the Grav API plugin. The private requireSuper function checks isSuperAdmin and returns early, skipping the requirePermission function where...