CVE-2026-72829: Getgrav Grav

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a result, an api.users.write-scoped key minted on a super account can set access.api.super or assign a super-granting group to mint or promote a full super account, then authenticate as that account for uncapped administrative privileges.

Affected products

• Getgrav Grav: before 1.0.13 (fixed in 1.0.13)

Published 2026-08-14. Last modified 2026-08-31.