2 matches found
EUVD-2026-58637
The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...
5.4CVSS5.4AI score0.00193EPSS
SaveExploits0References2
CVE-2026-72823
The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...
5.3AI score0.00193EPSS
SaveExploits0References3
20