Grav Plugin API CVE-2026-72828

Exploitation requires possession of a valid API key scoped to api.users.write that was issued from a super admin account on the target Grav installation - not any API key, specifically one minted under a super admin context. The Grav Plugin API plugin must be installed and active (it is not part of Grav core and must be separately enabled), and the API endpoint must be network-accessible to the attacker. The attacker must be able to complete the invitation acceptance step, which can be self-performed by registering with the generated invitation link without requiring any victim interaction. Exploitation is limited by: the requirement for a pre-existing API key tied to a super admin account; the Plugin API being installed and exposed; and any network-layer controls that might block access to the API. There is no requirement for an additional victim to take any action if the attacker self-accepts the invitation.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N with VC:H/VI:H/VA:H) scoring 8.6 accurately captures the attack geometry: network exposure is correct because the API is HTTP-accessible, complexity is low once prerequisites are met, and the full CIA impact triad is justified because a super-admin account has unrestricted control over the CMS. However, the PR:H rating is the most important signal for triage - exploitation requires the attacker to already possess a valid api.users.write API key issued from a super admin account, making this a second-stage or insider-abuse scenario rather than an opportunistic unauthenticated attack. No EPSS score was present in the intelligence data, and the vulnerability is absent from the CISA KEV catalog, so no confirmed in-the-wild exploitation is known; the absence of a public POC further reduces immediate mass-exploitation risk. That said, even a mid-sized municipal IT team in inowroclaw running an internet-exposed Grav API with long-lived or broadly distributed API keys should treat this as urgent, since a leaked or over-issued key is a realistic precondition in many operational environments. The practical risk is high in deployments with poor API key hygiene and low in tightly controlled environments with short-lived keys issued from non-super accounts.

An attacker who has obtained an api.users.write API key originally minted under a super admin Grav account sends a crafted HTTP POST to the InvitationsController endpoint, constructing an invitation payload that includes super-admin group membership and admin flags. Because isSuperAdmin() evaluates against the owning account rather than the key's declared scope, these flags survive validation; the attacker then accepts the generated invitation link by self-registering, and the resulting account is created with full super-admin privileges. No public exploit code has been identified at time of analysis.