Grav CMS API CVE-2026-72826

Exploitation requires the attacker to possess a valid API key scoped with at minimum the api.access permission AND that key must be associated with a super account in Grav (i.e., the account backing the key must hold super privileges at the application level). The vulnerability is triggered via the createApiKey API endpoint over the network; no special network position or man-in-the-middle capability is required. What limits exploitation: the attacker must have already obtained some form of API key on a super account - pure external attackers with no prior credential hold cannot exploit this directly. Non-super accounts cannot exploit this flaw to generate super keys regardless of scopes held. No user interaction is required once the key is in hand. Default Grav installations that have not provisioned any API keys are not exposed to this specific attack path.

The CVSS 4.0 score of 8.7 accurately reflects the high-impact outcome (full confidentiality, integrity, and availability compromise of the Grav instance) achievable over the network with only low privilege. The key qualifying condition - the attacker must already hold a minimal-scope API key tied to a super account - represents a meaningful prerequisite that reduces real-world exposure compared to an unauthenticated vulnerability, but once satisfied the exploitation step is trivially simple: a single crafted HTTP request. EPSS at 0.30% (23rd percentile) signals low current automated exploitation activity, consistent with the absence of a CISA KEV listing, though the technique is straightforward enough that any operator running an exposed Grav API endpoint should treat this as urgent regardless of the low EPSS figure - even a mid-sized municipal IT team in mielec running a Grav-powered intranet on a super-privileged API account would face a realistic escalation path. The most significant real-world risk multiplier is the downstream RCE chain: configuration-write access in Grav can be leveraged to achieve arbitrary code execution, elevating the effective impact well beyond the API privilege boundary. No POC or KEV evidence is present, but the attack is self-evidently reproducible from the description alone.

An attacker who has previously obtained a minimal-scope API key associated with a super account - for example, through credential reuse, a prior lower-severity disclosure, or social engineering - sends a single HTTP POST to the Grav API's createApiKey endpoint with a JSON body specifying an empty scopes array. The server, performing no subset-intersection check, mints and returns a new API key with full super-account privileges and no scope restrictions. The attacker then uses this unrestricted key to write arbitrary content to the Grav configuration, achieving remote code execution on the underlying server. No public exploit code is confirmed, but the attack is reproducible directly from the vulnerability description.