CVE-2026-72829 getgrav CVE debrief

Who should care

Users of Grav API plugin versions before 1.0.13 should verify and apply patches. System administrators, security teams, and operators who manage Grav API plugin deployments are particularly affected. They should review the vulnerability details, assess their exposure, and apply patches or mitigations as needed. Additionally, security teams should monitor for exploitation attempts and review compensating controls for exposed systems.

Technical summary

The Grav API plugin before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a result, an api.users.write-scoped key minted on a super account can set access.api.super or assign a super-granting group to mint or promote a full super account, then authenticate as that account for uncapped administrative privileges. This vulnerability allows attackers to bypass intended access controls and gain elevated privileges.

Defensive priority

CVE-2026-72829 is rated HIGH with a CVSS score of 8.7; verify and apply patches from the vendor immediately.

Recommended defensive actions

• Verify affected systems using official records
• Apply patches from the vendor
• Monitor for exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-72829 details indicate a HIGH severity vulnerability with a CVSS score of 8.7. Users of Grav API plugin versions before 1.0.13 should verify and apply patches. The vulnerability allows an api.users.write-scoped key minted on a super account to set access.api.super or assign a super-granting group to mint or promote a full super account. This could lead to uncapped administrative privileges. Verify affected systems using official records and monitor for exploitation attempts.

Official resources