CVE-2026-19639 Improper Access Control

An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope...

CVE-2026-72829

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

CVE-2026-72825

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...

CVE-2026-72833

The Grav API plugin (getgrav/grav-plugin-api) versions 1.0.6–1.0.11 contain a privilege-escalation vulnerability. A scoped API key minted on a super-admin account bypasses the scope cap on four isSuperAdmin()-gated write endpoints (GroupsController, AccountsConfigController, PreferencesController...

CVE-2026-72830

Grav API plugin before 1.0.13 is vulnerable to a ConfigController scope bypass that enables scoped api.config.write keys to modify scheduler configuration. This allows injection of arbitrary commands into scheduler.custom_jobs which can execute via Symfony Process, leading to remote code executio...

CVE-2026-72830 Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...

EUVD-2026-58644

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...

CVE-2026-72829

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

CVE-2026-72829 Grav before 1.0.13 API Key Scope Bypass via UsersController

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

EUVD-2026-58643

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

CVE-2026-72829

CVE-2026-72829 affects Grav plugin Grav API API-key scope bypass in UsersController create()/update() for getgrav/grav-plugin-api ≤ 1.0.12. The code enforces scope caps only for api.users.write, but uses a bare isSuperAdmin() check reading access.api.super, bypassing key scopes. This allows an ap...

CVE-2026-72826

The CVE affects the getgrav/grav-plugin-api plugin before 1.0.13. It does not validate that the scopes of a newly created API key are a subset of the caller’s scopes in createApiKey; the key’s scopes are read from the request body with no subset check. As a result, an attacker with a minimal-scop...

EUVD-2026-58640

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

CVE-2026-72825

The CVE affects getgrav/grav-plugin-api prior to 1.0.13. The ReportsController POST /reports/twig-content/allowlist enforces api.config.write then uses a bare isSuperAdmin() check instead of requireSuper(), causing an API key with scoped access to api.config.write minted on a super account to byp...

EUVD-2026-58638

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

CVE-2026-72825 Grav before 1.0.13 API-key scope cap bypass via ReportsController

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...

CVE-2026-72824 Grav before 1.0.13 API Key Scope Bypass via PagesController

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

CVE-2026-72825

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...

CVE-2026-72824

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

EUVD-2026-58637

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...