CVE-2026-72829: High Super Account Mint in Grav Users API

CVE-2026-72829 is a privilege management flaw in the Grav API plugin. A key scoped only to user writes could create or promote a full super account, because super grants relied on a check that ignored key scopes. The record scores it 8.8, High. Upgrade getgrav/grav-plugin-api to 1.0.13.

What's affected

The record says the getgrav/grav-plugin-api Composer package is affected before 1.0.13. The GitHub advisory lists affected versions as 1.0.12 and earlier, with 1.0.13 as the patched release.

The advisories share one root cause. The plugin enforces its API key scope limits in a single place, inside a permission check that runs before the super user shortcut. Several controllers instead use a bare super user check that reads the account setting directly and never looks at the key's scopes. A least privilege key created on a super account therefore passes any of those bare checks and its scope limit is skipped. In the users controller, the create and update methods apply the scope cap only for api.users.write. They then decide whether the caller may grant super privileges using a bare super user check. A key scoped to api.users.write on a super account passes both, so it can set the super flag directly or assign a group that grants it. The result is a new or promoted full super account, which the attacker can then sign in to.

The weakness class is CWE-269, improper privilege management.

How to check if you're exposed

Check the version of the Grav API plugin on every site.

composer show getgrav/grav-plugin-api

If you installed the plugin through the Grav package manager instead of Composer, read the version from the plugin's own files or the plugin list in the Grav admin. Any version up to 1.0.12 is affected. Then check whether you have issued scoped API keys. The advisory explains that the weakness depends on a key with limited scopes that was created on a super user account, or on an account that holds the api.users.write permission in its access list. If nobody uses API keys, your exposure is smaller, but upgrade anyway.

Also review your user list for super accounts. Any account with super access that you do not recognise should be investigated before and after the upgrade.

What to do now

1. Upgrade getgrav/grav-plugin-api to 1.0.13 or later.
2. Audit all accounts for super access and remove it from any account that should not have it.
3. Check group definitions for groups that grant super rights.
4. Delete unused API keys and keep scopes narrow on the rest.
5. Review account creation and promotion events in your logs.
6. Reset passwords and sessions for accounts you cannot account for.

Why it matters

The advisories share one root cause. The plugin enforces its API key scope limits in a single place, inside a permission check that runs before the super user shortcut. Several controllers instead use a bare super user check that reads the account setting directly and never looks at the key's scopes. A least privilege key created on a super account therefore passes any of those bare checks and its scope limit is skipped.

A key that can write users is already powerful. This flaw makes it more powerful than its label says, because the label and the real reach disagree. Scopes are only useful as a security boundary if every code path honors them.

The record scores this High under CVSS 3.1. The GitHub advisory also labels it High, while VulnCheck lists it as critical under CVSS 4.0 with a score of 9.3. If you use scoped API keys as a security control, read the VulnCheck rating as the more accurate one. No source reports exploitation in the wild, and the CVE is not in the CISA KEV catalog. The advisory also notes that an earlier fix, for CVE-2026-65897 and CVE-2026-65895, covered only four controllers, which shows that this class of mistake can recur when each controller carries its own check.

Quick check

Sources

• GitHub security advisory for Grav
• VulnCheck advisory

Last reviewed: 18 October 2026.