Grav API Plugin CVE-2026-65897

Exploitation requires an authenticated caller possessing the api.users.write scope (PR:L in the CVSS vector), and the concrete prerequisite is the unvalidated groups parameter passed to InvitationsController::create() in the Grav API Plugin before 1.0.10 - the attacker sets that field to a group that confers api.super. The escalation only completes when the created invitation is accepted, provisioning the elevated account, so acceptance of the invite is a required real-world step. Limiting factors: the attacker must first hold a valid api.users.write credential (this is not unauthenticated), the target must be running a pre-1.0.10 version of the plugin with the invitations feature in use, and a group granting api.super must exist to be assigned.

The CVSS 4.0 base score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and full VC:H/VI:H/VA:H impact, reflecting network-reachable, low-complexity exploitation that requires low privileges (PR:L) and no user interaction on the attacker's side. The signal set is internally consistent: an attacker must already hold a valid api.users.write credential, which is why this is escalation-of-privilege rather than a pre-auth compromise, but from that foothold the impact is total (full super-admin API access). No EPSS score, KEV entry, or public POC is present in the provided data, so real-world exploitation pressure is currently unquantified - this is a genuine high-severity issue for any deployment that provisions limited API user-management accounts, but exploitation depends on an attacker first obtaining such an account. Note that acceptance of the invitation is required for the escalation to take effect, a real limiting factor not captured in the base CVSS UI:N metric (which scores attacker-side interaction, not victim/workflow steps).

An attacker who has obtained a low-privileged API token scoped only to api.users.write sends a crafted invitation-create request that sets the groups field to a group carrying api.super. The victim (or the attacker via a controlled email) accepts the invitation, and the newly provisioned account silently gains full super-admin API access, letting the attacker take over the Grav instance despite never holding super-admin rights themselves. No public POC is currently identified, and the low attack complexity (AC:L) means the request requires no special timing or brute force once the groups field is known.