CVE-2026-72829: Privilege Escalation in Grav API Plugin

The Grav API plugin (getgrav/grav-plugin-api) versions prior to 1.0.13 are susceptible to an API-key scope-cap bypass vulnerability located within the UsersController's create() and update() methods. The vulnerability stems from an insecure authorization check where the application enforces scope caps for 'api.users.write' but fails to validate super-privilege grants against the key's defined scopes. Instead, the application performs a direct 'isSuperAdmin()' check that inspects the 'access.api.super' attribute. By leveraging an API key with 'api.users.write' scope, an attacker can modify user records to assign super-admin privileges or group memberships that grant such access. This allows for the elevation of a limited API account to a full super-administrator, resulting in complete administrative control over the Grav instance.

Impact

Successful exploitation allows an unprivileged or low-privileged API user to elevate their account to a super-administrator, leading to full site compromise, sensitive data exfiltration, and unauthorized configuration changes. This vulnerability carries a CVSS v3.1 base score of 9.8.

Recommendation

• Upgrade the Grav API plugin (getgrav/grav-plugin-api) to version 1.0.13 or later immediately.
• Audit existing API keys for unexpected or unauthorized super-user privilege grants in the user access settings.
• Restrict the generation and distribution of API keys with 'api.users.write' scopes until the patch is applied.