CVE-2026-65897: Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API Pluginto a version that resolves this vulnerability.Fixed in 1.0.10Patch Privilege Escalation via Invitations groups
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65897?
CVE-2026-65897 has a high severity score of 8.8.
How do I fix CVE-2026-65897?
To fix CVE-2026-65897, upgrade the Grav API Plugin to version 1.0.10 or later.
What causes CVE-2026-65897?
CVE-2026-65897 is caused by a failure to validate the groups field in the InvitationsController::create() method.
Who is affected by CVE-2026-65897?
Authenticated users with 'api.users.write' permission are affected by CVE-2026-65897.
What type of vulnerability is CVE-2026-65897?
CVE-2026-65897 is a privilege escalation vulnerability in the Grav API Plugin.