EUVD-2026-58644

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...

PT-2026-71999

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.13 Description Failure to enforce API key scope caps in ConfigController super-scope gates allows scoped keys to modify scheduler configuration. An attacker possessing a scoped api.config.write key can...