Grav API Plugin CVE-2026-72833

The Grav API plugin (getgrav/grav-plugin-api) must be installed and enabled at versions 1.0.6 through 1.0.11. The attacker must possess a valid API key that was issued by or associated with a super-admin account - the key's declared scope does not matter and can be entirely read-only (e.g., api.pages.read). No write permission on the key itself is required. The API must be network-reachable. Exploitation is bounded by the following limiting factors: (1) the API plugin must be explicitly installed - it is not bundled with base Grav; (2) a super-admin-associated API key must exist and be obtainable by the attacker, ruling out purely unauthenticated exploitation; (3) only the four specific endpoints (GroupsController, AccountsConfigController, PreferencesController, DashboardWidgetController) are affected - not all API operations are bypassed.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N) accurately reflects the risk profile: network-exploitable over standard HTTP, low complexity once a key is in hand, and requiring only low-privilege credentials (a scoped API key). The impact triple of VC:H/VI:H/VA:H is justified because super-admin write access enables full ACL rewriting, account takeover, configuration changes, and potential content destruction. The critical amplifier here is the delegated key scenario: organizations routinely issue read-only API keys to CI/CD pipelines, uptime monitors, or third-party integrations - these keys are often stored in environment variables or secrets managers with broader access than the Grav instance itself, increasing the likelihood of leakage. There is no KEV listing and no confirmed public exploit code, which moderates urgency somewhat, but the bug is mechanically trivial to exploit once the key-bypass logic is understood. EPSS data was not provided in the input; the straightforward exploitation path suggests real-world exploitation probability is non-negligible for sites that have issued delegated API keys.

An attacker obtains a read-only API key (e.g., api.pages.read scope) originally issued to a CI pipeline - via a leaked .env file, a compromised secrets manager, or insider access. The attacker sends an authenticated POST request to the GroupsController write endpoint with a crafted payload that rewrites the ACL map for a target group, granting super-admin privileges to an attacker-controlled account. Because the endpoint's isSuperAdmin() check passes (the key was minted on a super-admin account) and requirePermission() is never called, the operation succeeds despite the key's declared read-only scope, yielding full administrative control of the Grav instance.