PatchSiren cyber security CVE debrief
CVE-2026-72830 getgrav CVE debrief
The Grav API plugin, versions before 1.0.13, contains a vulnerability that allows scoped API keys to write scheduler configuration due to improper enforcement of API key scope caps in ConfigController super-scope gates. This can lead to operating system command execution as the web server user. The vulnerability arises because the scope cap is applied only inside requirePermission(), whereas the scheduler and backups gates use a bare isSuperAdmin() check that does not consult api_key_scopes. To address this, defenders should focus on applying patches for Grav API plugin version 1.0.13 or later, restricting API key scopes to minimal required permissions, and monitoring scheduler configuration for unauthorized changes. Limited information is available about affected products and versions. To verify and mitigate this vulnerability, defenders should review the official CVE record and NVD details, assess their deployments for affected versions, and apply patches or mitigations as recommended by the vendor. Additional compensating controls, such as restricting API key scopes and monitoring scheduler configuration, should be considered while remediation is planned and verified. The CVE record was published on 2026-08-14T12:16:46.277Z and has not been modified since then. The NVD entry is currently Received.
- Vendor
- getgrav
- Product
- grav
- CVSS
- HIGH 8.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-14
- Original CVE updated
- 2026-08-24
- Advisory published
- 2026-08-14
- Advisory updated
- 2026-08-24
Who should care
Administrators and users of Grav API plugin versions before 1.0.13 should be aware of this vulnerability and take immediate action to secure their systems. This includes reviewing and applying patches, restricting API key scopes, and implementing additional access controls for ConfigController. Operators, platform administrators, vulnerability management teams, and security teams should assess their deployments and prioritize remediation based on their exposure and potential impact.
Technical summary
The Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates. This allows scoped keys to write scheduler configuration, potentially leading to operating system command execution as the web server user. The vulnerability arises from the scope cap being applied only inside requirePermission(), while the scheduler and backups gates use a bare isSuperAdmin() check that never consults api_key_scopes. To address this, defenders should focus on applying patches for Grav API plugin version 1.0.13 or later, restricting API key scopes to minimal required permissions, and monitoring scheduler configuration for unauthorized changes.
Defensive priority
CVE-2026-72830 is rated HIGH with a CVSS score of 8.7; verify and apply patches immediately.
Recommended defensive actions
- Apply patches for Grav API plugin version 1.0.13 or later
- Restrict API key scopes to minimal required permissions
- Monitor scheduler configuration for unauthorized changes
- Implement additional access controls for ConfigController
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE-2026-72830 details indicate that Grav API plugin versions before 1.0.13 are vulnerable due to improper enforcement of API key scope caps in ConfigController, allowing for operating system command execution. Limited information is available about affected products and versions. To verify and mitigate this vulnerability, defenders should review the official CVE record and NVD details, assess their deployments for affected versions, and apply patches or mitigations as recommended by the vendor. Additional compensating controls, such as restricting API key scopes and monitoring scheduler configuration, should be considered while remediation is planned and verified.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-14T12:16:46.277Z and has not been modified since then.