CVE-2026-72829 | BDVDB-2026-359336 Detail

Description#

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a result, an api.users.write-scoped key minted on a super account can set access.api.super or assign a super-granting group to mint or promote a full super account, then authenticate as that account for uncapped administrative privileges.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-14Record published in the CVE List.
2. Version 22026-08-24Most recent update recorded in the CVE List.