Critical Grav CMS plugin bug let low-privilege API keys mint themselves 'super' access

A newly disclosed vulnerability in the API plugin for the open-source Grav CMS has picked up a maximum-strength CVSS score of 9.8, the kind of number that usually sends security teams scrambling. The bug is real and has been fixed, but the practical blast radius is a lot narrower than the headline score suggests.

What the bug actually does

The issue, tracked as CVE-2026-72826, lives in grav-plugin-api, the official add-on that lets Grav sites manage API keys with defined permission “scopes”. According to the GitHub security advisory published by Grav maintainer rhukster, the plugin’s createApiKey function was supposed to check that any new API key’s scopes were a subset of the scopes held by whoever was creating it.

For keys created for the caller’s own account, that check never happened. The code simply required the baseline api.access scope and pulled the new key’s permissions straight out of the request body, with no validation. Worse, a quirk in the scope-capping logic meant that submitting an empty scopes array wasn’t treated as “no permissions” - it was treated as unrestricted. So a caller could send {"scopes":[]} and receive back a key with full access.

So who is actually at risk

This isn’t a hole that lets a random visitor waltz into your site. To exploit it, an attacker needs to already hold a valid, if minimal, API key belonging to a “super” account on the target Grav installation. From that limited foothold, they could mint themselves a brand-new, fully unscoped key with super-account privileges - and from there, per the advisory, potentially chain into writing configuration files and achieving full remote code execution.

In other words, the danger is privilege escalation from an existing low-level credential, not an open door for anyone on the internet. Sites that don’t use the grav-plugin-api add-on at all, or that don’t issue scoped API keys to super accounts, aren’t exposed by this flaw. VulnCheck’s advisory and NVD both rate it critical - VulnCheck put it at 9.8 under CVSS 3.1 and 9.3 under the newer CVSS 4.0 scale - reflecting how damaging a successful chain could be, not how easy it is to pull off from scratch.

Nothing in the published advisories claims the bug has been spotted being exploited in the wild, and none of the sources give a figure for how many Grav sites actually run this particular plugin. Grav itself is a modest but established flat-file CMS used by developers and small organisations rather than a mass-market platform like WordPress, so the overall footprint is likely to be far smaller than for a mainstream CMS vulnerability.

What to do about it

The fix is straightforward: grav-plugin-api version 1.0.13 closes the gap by properly enforcing that new key scopes can’t exceed the caller’s own. Anyone running the plugin should update immediately, and it’s worth auditing existing API keys - particularly any tied to super accounts - to check none have already been quietly upgraded to full access.

The takeaway

This is a genuine, now-patched flaw with a serious ceiling if chained further, but it only matters to the specific slice of Grav CMS users running the API plugin with scoped keys on privileged accounts. If that’s you, patch today. If it isn’t, there’s no reason for alarm.