CVE-2026-72826: Getgrav Grav

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super account can submit an empty scopes array to mint an unscoped, full-access super key, bypassing scope restrictions (and enabling further chains such as configuration write to RCE).

Affected products

• Getgrav Grav: before 1.0.13 (fixed in 1.0.13)

Published 2026-08-14. Last modified 2026-09-08.