CVE-2026-72830: Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. The scope cap is applied only inside requirePermission(), while the scheduler and backups gates use a bare isSuperAdmin() check that never consults apikeyscopes. An attacker holding an API key scoped to api.config.write that was minted on a super account can therefore inject arbitrary commands into scheduler.customjobs, which Job::run() passes to a Symfony Process, achieving operating system command execution as the web server user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API pluginto a version that resolves this vulnerability.Fixed in 1.0.13 - Compensating control
Remove or rotate any API keys that could have been minted on a super account (with scope including api.config.write), since they can write scheduler.custom_jobs and lead to OS command execution.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72830?
The severity of CVE-2026-72830 is critical, with a CVSS score of 9.8.
How do I fix CVE-2026-72830?
To fix CVE-2026-72830, update the Grav API Plugin to version 1.0.13 or later.
What does CVE-2026-72830 allow attackers to do?
CVE-2026-72830 allows attackers to execute arbitrary commands by injecting them into scheduler.custom_jobs through a scope bypass.
Which versions of the Grav API Plugin are affected by CVE-2026-72830?
All versions of the Grav API Plugin prior to version 1.0.13 are affected by CVE-2026-72830.
What type of vulnerability is CVE-2026-72830?
CVE-2026-72830 is a Remote Code Execution (RCE) vulnerability.