CVE-2026-72828

Grav Plugin API getgrav/grav-plugin-api before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin check rather than a scope-aware permission check, so a least-privilege API key scoped to api.users.write...

CVE-2026-72824 Grav before 1.0.13 API Key Scope Bypass via PagesController

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

CVE-2026-72828: Improper Privilege Management

Grav Plugin API getgrav/grav-plugin-api before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin check rather than a scope-aware permission check, so a least-privilege API key scoped to api.users.write...

PT-2026-71994

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...

CVE-2026-72833: Improper Privilege Management

The Grav API plugin getgrav/grav-plugin-api versions = 1.0.6 and = 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin-gated write endpoints in GroupsController, AccountsConfigController,...

CVE-2026-57996

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin accounts. A delegated administrator with USERADD/EDIT/DELETE permissions can call POST /admin/api/user/add with isSuperAdmin: true and...

CVE-2026-57996 phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin accounts. A delegated administrator with USERADD/EDIT/DELETE permissions can call POST /admin/api/user/add with isSuperAdmin: true and...

Privilege Escalation

thorsten/phpmyfaq is vulnerable to Privilege Escalation. The vulnerability exists because of the insufficient permission checks in the user.php, which allows an attacker to gain escalated privilege through the isSuperAdmin feature...