CVE-2026-72823

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...

CVE-2026-72823

The Grav API plugin (getgrav/grav-plugin-api) prior to 1.0.13 is impacted. Its DemoController contains a private requireSuper() check for isSuperAdmin() that returns early and skips requirePermission(), bypassing the api_key_scopes enforcement. Consequently, a scoped API key minted on a super acc...