CVE-2026-72823

The Grav API plugin (getgrav/grav-plugin-api) prior to 1.0.13 is impacted. Its DemoController contains a private requireSuper() check for isSuperAdmin() that returns early and skips requirePermission(), bypassing the api_key_scopes enforcement. Consequently, a scoped API key minted on a super acc...

PT-2026-71992

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the api key scopes cap enforced only in requirePermission is skipped. As a...