PatchSiren cyber security CVE debrief

CVE-2026-72826 getgrav CVE debrief

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. This allows an attacker with a minimal-scope API key on a super account to create an unscoped, full-access super key, potentially enabling further exploitation. The vulnerability is rated HIGH with a CVSS score of 8.7, indicating a high severity. Users of the plugin should verify and apply patches to prevent API key scope bypass. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. Official advisories or CVE records should be reviewed to validate affected scope, severity, and vendor guidance. Vendor-supported updates or mitigations should be planned through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked, and exceptions should be tracked. Remediated assets should be retested, and the item should only be closed after evidence is documented. The CVE record was published on 2026-08-14T12:16:45.780Z and has not been modified since then. The NVD entry is currently Received.

Vendor: getgrav
Product: grav-plugin-api
CVSS: HIGH 8.7
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-08-14
Original CVE updated: 2026-08-24
Advisory published: 2026-08-14
Advisory updated: 2026-08-24

Who should care

Users of getgrav/grav-plugin-api plugin version before 1.0.13, especially those with super accounts or high-privilege API keys, should verify and apply patches to prevent API key scope bypass. Additionally, security teams and vulnerability management teams should review the vulnerability and apply patches or mitigations as needed. Operators of affected systems should also review the vulnerability and take necessary actions to prevent exploitation.

Technical summary

Defensive priority

CVE-2026-72826 is rated HIGH with a CVSS score of 8.7; verify and apply vendor patches immediately.

Recommended defensive actions

Verify and apply the vendor patch for getgrav/grav-plugin-api plugin version 1.0.13 or later.
Restrict API key creation to trusted users and validate scopes.
Monitor for unusual API key creation activity.
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. Evidence is based on CVE and NVD records; further details may be limited. The vulnerability allows an attacker with a minimal-scope API key on a super account to create an unscoped, full-access super key, potentially enabling further exploitation. Defenders should verify API key creation and usage, review current API keys for suspicious activity, and apply patches immediately.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-14T12:16:45.780Z and has not been modified since then.