CVE-2026-65897CWE-269privilege-escalation

CVE-2026-65897

High · published July 23, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
43.5
In the wild
Unconfirmed
What it is

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00523 · 43.5th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-07-23T16:18Z
References (5)
https://github.com/getgrav/grav-plugin-api/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd · [email protected]https://github.com/getgrav/grav/commit/345e79e3abf8c15f80e612a09f6643300071324b · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv · [email protected]https://www.vulncheck.com/advisories/grav-api-plugin-privilege-escalation-via-invitations-groups · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 23 JUL 11:42Z
    Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups
    cvelistv5