CVE-2026-72833: falha de alta gravidade em getgrav grav-plugin-api
Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.5%
The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin()-gated write endpoints (in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController). These endpoints authorize via a super-admin early-return that never invokes requirePermission()—the sole enforcement point of the scope cap—so a 'read-only'-scoped key (e.g. api.pages.read) can perform super-only write operations, including rewriting group ACL maps to grant super-admin privileges to arbitrary accounts. A leaked or delegated read-only CI/monitoring key can therefore gain full super-admin write capability. Fixed in 1.0.13.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
getgrav · grav-plugin-apiCVEs relacionadas — getgrav grav-plugin-api
No mesmo produto, das mais perigosas para as menos.
CVE-2026-112779CRITICALGrav API Plugin before 1.0.42 Cache Exhaustion and Page Permission BypassEPSS 0.8%CVE-2026-62666HIGHGrav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of superEPSS 0.6%CVE-2026-63408HIGHGrav API Plugin: JWT Access Token Accepted via `?token=` URL Query ParameterEPSS 0.5%CVE-2026-72826HIGHGrav API Plugin before 1.0.13 Scope Bypass via createApiKeyEPSS 0.5%CVE-2026-62668CRITICALGrav API Plugin: Webhook SSRF via Unrestricted cURL ProtocolsEPSS 0.4%CVE-2026-86196HIGHGrav API Plugin before 1.0.20 Authentication Bypass via Host HeaderEPSS 0.4%