Grav API Plugin CVE-2026-72830

The attacker must possess a valid Grav API key that carries the api.config.write scope. This scope is the precise and sole prerequisite: the vulnerability exists because this scope should be blocked from modifying scheduler configuration by the super-scope gate, but is not. Environments that have never issued api.config.write keys, or that have disabled the API plugin entirely, are not exploitable. Exploitation is further constrained by the need to reach the API endpoint over the network - installations behind a firewall or VPN that blocks external API access reduce exposure. No other special configuration, feature flag, or deployment mode is required beyond having an issued api.config.write key in circulation. Authentication is required (PR:L per CVSS 4.0), so unauthenticated exploitation is not possible.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects network-reachable exploitation with low attack complexity requiring only a low-privilege API key. SSVC assesses exploitation status as 'poc' (public exploit code exists), the attack as automatable, and technical impact as total - a combination that signals urgent remediation priority. The EPSS score of 0.44% at the 37th percentile is notably low given these signals, which likely reflects that Grav's deployment footprint is niche rather than that the vulnerability is difficult to exploit; the disconnect between low EPSS and high SSVC severity is not a contradiction but a scale effect. No CISA KEV listing is present, meaning confirmed mass exploitation has not been observed, but the automatable + poc + total-impact profile means that window may close quickly. The PR:L requirement is the primary limiting factor: an attacker must first obtain a valid api.config.write scoped key, which constrains opportunistic exploitation but does not protect against insider threats, stolen credentials, or environments that distribute API keys broadly.

An attacker who has obtained a valid api.config.write scoped API key - through credential stuffing, a compromised integration account, or an insider - sends a crafted PATCH or PUT request to the ConfigController endpoint targeting the scheduler.custom_jobs configuration key, injecting an OS command payload. Because the super-scope gate is not enforced for this path, the request succeeds, and when the Grav scheduler next runs, Symfony Process executes the injected command in the context of the web server process. A public exploit exists per SSVC data, so the mechanics of this request are not obscure.