Broken access control in Grav API Plugin configuration scopes (CVE-2026-65895)

The Grav API Plugin's ConfigController fails to restrict the `plugins/api` configuration scope to the `api.super` privilege, allowing authenticated users holding only `api.config.write` to modify the API plugin's own security settings via PATCH /config/plugins/api. An attacker can disable rate limiting site-wide - removing the platform's only defense against brute-forcing passwords, invitation tokens, password-reset tokens, and API keys - and can rewrite the CORS allow-list to include an attacker-controlled origin with credentials enabled, altering the API's declared cross-origin trust boundary for all users. Affected versions: - <=1.0.9 We recommend updating to: 1.0.10. CVSS 8.2 · our assessment: this_week Reference: https://github.com/getgrav/grav/security/advisories/GHSA-4pqv-2qj5-38fp Details: https://vuln.today/cve/CVE-2026-65895