Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 5 total.
Missing scope enforcement on disable2fa endpoint in getgrav/grav-plugin-api (CVE-2026-72822)
The grav-plugin-api Composer package fails to invoke requirePermission() on the admin (non-self) path of the disable2fa endpoint, meaning the api_key_scopes cap is never applied. A holder of a narrow-scope API key on ...
Fixed in 1.0.13
API key scope-cap bypass enabling SSTI in Grav API plugin (CVE-2026-72824)
The Grav API plugin's `PagesController::guardTwigContent()` enforces the Twig-toggle check with a bare `isSuperAdmin()` gate that never consults `api_key_scopes`. A least-privilege API key scoped only to `api.pages.wr...
Fixed in 1.0.13
API key scope escalation in Grav CMS plugin API (CVE-2026-72826)
The getgrav/grav-plugin-api plugin does not validate that scopes assigned to a newly created API key are a subset of the requesting caller's own scopes. An attacker with a minimal api.access-scoped key on a super acco...
Fixed in 1.0.13
API-key scope cap bypass in Grav API plugin UsersController (CVE-2026-72829)
The Grav API plugin's UsersController create() and update() methods enforce the scope cap only for api.users.write but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly wi...
Fixed in 1.0.13
API-key scope cap bypass in Grav API plugin enabling RCE (CVE-2026-72830)
The Grav API plugin's `ConfigController` enforces the API-key scope cap in only one location (`AbstractApiController::requirePermission()`), which is bypassed by super-scope gates that rely on a bare `isSuperAdmin()` ...
Fixed in 1.0.13