CVE-2026-72826
Grav before 1.0.13 Scope Bypass via createApiKey
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super account can submit an empty scopes array to mint an unscoped, full-access super key, bypassing scope restrictions (and enabling further chains such as configuration write to RCE).
| CWE | CWE-266 |
| Vendor | getgrav |
| Product | grav |
| Published | Aug 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for getgrav grav
Be the first to know when new critical vulnerabilities affecting getgrav grav are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
getgrav / grav
0 < 1.0.13
References
Credits
🔍 manus-use