CVE-2026-72833: Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys

Published Aug 14, 2026
·
Updated

The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin()-gated write endpoints (in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController). These endpoints authorize via a super-admin early-return that never invokes requirePermission()—the sole enforcement point of the scope cap—so a 'read-only'-scoped key (e.g. api.pages.read) can perform super-only write operations, including rewriting group ACL maps to grant super-admin privileges to arbitrary accounts. A leaked or delegated read-only CI/monitoring key can therefore gain full super-admin write capability. Fixed in 1.0.13.

Affected Software

1 affected component
Grav getgrav/grav-plugin-api>=1.0.6<=1.0.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade getgrav/grav-plugin-api to a version that resolves this vulnerability.

    Fixed in 1.0.13
  2. Compensating control

    Revoke/rotate any potentially leaked or delegated CI/monitoring key and any scoped API keys minted from a super-admin account (read-only scope such as api.pages.read) that could have been used to call the isSuperAdmin()-gated write endpoints (GroupsController, AccountsConfigController, PreferencesController, DashboardWidgetController).

Event History

Aug 14, 2026
CVE Published
via MITRE·11:35 AM
Data Sourced
via MITRE·11:35 AM
DescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-72833?

The severity of CVE-2026-72833 is high, with a score of 8.8 according to the CVSS metrics.

2

How do I fix CVE-2026-72833?

To fix CVE-2026-72833, upgrade the Grav API plugin to version 1.0.12 or later.

3

What versions of the Grav API plugin are affected by CVE-2026-72833?

Grav API plugin versions between 1.0.6 and 1.0.11 are affected by CVE-2026-72833.

4

What type of vulnerability is CVE-2026-72833?

CVE-2026-72833 is classified as a privilege escalation vulnerability.

5

What consequences can arise from CVE-2026-72833?

Exploitation of CVE-2026-72833 can allow unauthorized users to gain super-admin rights through scoped API keys.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
CVE-2026-72833 - Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys - SecAlerts