CVE-2026-65897
Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.
| CWE | CWE-269 |
| Vendor | getgrav |
| Product | grav |
| Published | Jul 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for getgrav grav
Be the first to know when new high vulnerabilities affecting getgrav grav are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
getgrav / grav
0 < 1.0.10
References
github.com: https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv github.com: https://github.com/getgrav/grav/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd github.com: https://github.com/getgrav/grav/commit/345e79e3abf8c15f80e612a09f6643300071324b vulncheck.com: https://www.vulncheck.com/advisories/grav-api-plugin-privilege-escalation-via-invitations-groups
Credits
🔍 izumi-hyun