Which versions of Grav API Plugin are affected by CVE-2026-65897?

Grav's API Plugin before version 1.0.10 contains a privilege escalation flaw that allows lower-privileged API users to self-elevate to full administrator access through the account invitation…. A patch is available.

How to fix or mitigate CVE-2026-65897?

Within 24 hours, immediately disable the API Plugin invitation feature through configuration on all Grav instances and restrict API Plugin access to named administrators. Within 7 days, complete asset inventory of all Grav systems using the API Plugin, audit existing API tokens and permissions, revoke unnecessary privileges, and review access logs for suspicious invitation or group-modification attempts since plugin deployment. Within 30 days, coordinate with Grav maintainers regarding the version 1.0.10 release timeline; if unavailable within your remediation window, plan migration to an alternative API management solution or implement compensating controls as a long-term strategy.

Grav API Plugin CVE-2026-65897

Q: What is the CVSS score of CVE-2026-65897?

CVE-2026-65897 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-48247 HIGH

Improper Privilege Management (CWE-269)

2026-07-23 disclosure@vulncheck.com

GHSA-xcm3-8jr8-4m46

Privilege Escalation

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network API reachable with low complexity; PR:L because a valid api.users.write account is required; S:C as a low-priv scope crosses an authority boundary to grant super-admin, with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 23, 2026 - 14:04 EUVD

Analysis Generated

Jul 23, 2026 - 12:47 vuln.today

CVE Published

Jul 23, 2026 - 12:18 cve.org

HIGH 8.7

DescriptionCVE.org

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.

AnalysisAI

Privilege escalation in Grav's API Plugin before 1.0.10 lets an authenticated caller holding only the api.users.write scope create invitation records that assign the invited account to groups granting api.super, so when the invite is accepted the new account inherits full super-admin API access the inviter never possessed. The flaw stems from InvitationsController::create() failing to validate the attacker-supplied groups field. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Grav is a flat-file PHP CMS; its API Plugin exposes REST endpoints guarded by fine-grained scopes such as api.users.write and api.super. Group membership in Grav maps directly to permission grants, so a user placed in a group carrying api.super effectively becomes a super-admin. The vulnerability is a CWE-269 (Improper Privilege Management) issue: InvitationsController::create() trusts the client-supplied groups field without checking whether the requesting caller is itself entitled to grant those groups. This breaks the invariant that a user cannot delegate permissions they do not hold, turning a limited user-management scope into a path to full administrative control. The two referenced upstream commits (345e79e and f9438d4) implement the server-side validation that constrains which groups an inviter may assign.

RemediationAI

Vendor-released patch: upgrade the Grav API Plugin to version 1.0.10 or later, which adds validation of the groups field so an inviter can only assign groups within its own authority (fix commits https://github.com/getgrav/grav/commit/345e79e3abf8c15f80e612a09f6643300071324b and https://github.com/getgrav/grav/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd; advisory GHSA-m86m-jjcg-gcvv). If you cannot patch immediately, restrict or revoke the api.users.write scope from all accounts that do not strictly need it, and audit existing invitation records and group memberships for accounts unexpectedly holding api.super - the trade-off is that disabling api.users.write breaks legitimate delegated user-provisioning workflows. As an additional compensating control, disable or gate the invitations endpoint at the reverse proxy so only trusted administrative accounts can reach InvitationsController::create(), accepting that this blocks self-service invitation flows until the upgrade is applied.