CVE-2026-72830: Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony Process for remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API Pluginto a version that resolves this vulnerability.Fixed in 1.0.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72830?
The severity of CVE-2026-72830 is critical, with a CVSS score of 9.8.
How do I fix CVE-2026-72830?
To fix CVE-2026-72830, update the Grav API Plugin to version 1.0.13 or later.
What does CVE-2026-72830 allow attackers to do?
CVE-2026-72830 allows attackers to execute arbitrary commands by injecting them into scheduler.custom_jobs through a scope bypass.
Which versions of the Grav API Plugin are affected by CVE-2026-72830?
All versions of the Grav API Plugin prior to version 1.0.13 are affected by CVE-2026-72830.
What type of vulnerability is CVE-2026-72830?
CVE-2026-72830 is a Remote Code Execution (RCE) vulnerability.