CVE-2026-72826: Grav before 1.0.13 Scope Bypass via createApiKey
The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super account can submit an empty scopes array to mint an unscoped, full-access super key, bypassing scope restrictions (and enabling further chains such as configuration write to RCE).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.13 - Configuration
In createApiKey, validate that the scopes provided in the request body for the newly created API key are a subset of the caller's scopes (i.e., reject requests where newly_created_key_scopes are not contained within caller_scopes).
getgrav/grav-plugin-api createApiKey scopes validation = caller_scopes must be a superset of newly_created_key_scopes - Compensating control
Until patched, ensure that minimal-scope API keys used by super accounts cannot mint full-access unscoped keys by enforcing external controls around API key creation (e.g., restrict who/what can call createApiKey and require stronger authorization than only the baseline api.access scope).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72826?
The severity of CVE-2026-72826 is rated as critical with a score of 9.8.
How do I fix CVE-2026-72826?
To fix CVE-2026-72826, upgrade to Grav before version 1.0.13 of the getgrav/grav-plugin-api plugin.
What are the potential impacts of CVE-2026-72826?
CVE-2026-72826 can lead to unauthorized access to sensitive data by allowing API keys with excessive scopes.
Who is affected by CVE-2026-72826?
CVE-2026-72826 affects users of Grav and the getgrav/grav-plugin-api plugin prior to version 1.0.13.
When was CVE-2026-72826 published?
CVE-2026-72826 was published on August 14, 2026.