CVE-2026-65897
Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups
- State
- Published
- Severity
- 8.7 High
- Published
- Jul 23, 2026
- Updated
- Aug 28, 2026
- Reserved
- Jul 23, 2026
Description
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
gravgetgrav |
|
References
- GitHub Security Advisory (GHSA-m86m-jjcg-gcvv)vendor-advisory
- Patch Commitpatch
- Patch Commitpatch
- VulnCheck Advisory: Grav API Plugin 1.0.9 Privilege Escalation via Invitations groupsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.