Privilege escalation via unvalidated groups field in Grav API Plugin (CVE-2026-65897)

InvitationsController::create() in the Grav API Plugin applies super-admin flag stripping to the `access` field but performs no equivalent authority check on the `groups` field, accepting it verbatim from the request body. An authenticated caller holding only api.users.write can create an invitation pre-configured with a group that confers api.super permissions; once the invitation is accepted, the resulting account holds full super-admin API access without the inviter having possessed those privileges. Affected versions: - <=1.0.9 We recommend updating to: 1.0.10. CVSS 8.7 · our assessment: this_week Reference: https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv Details: https://vuln.today/cve/CVE-2026-65897