API Key Scope Bypass Enables Privilege Escalation

Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so a least-privilege API key (scoped to api.users.write) minted on a super account can create an invitation record containing super-admin access flags. When the invitation is accepted, those flags are written verbatim to the new account, resulting in privilege escalation to a fully controlled super account.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Grav Plugin API versions before 1.0.13 contain a critical privilege escalation vulnerability in the InvitationsController where API-key scope restrictions are not properly enforced. The vulnerability allows a least-privilege API key—scoped only for user write operations—to create invitation records containing super-admin access flags when issued from a super-admin account. When victims accept these invitations, the super-admin flags are written directly to their accounts, effectively granting unauthorized administrative privileges. This affects any Grav installation using the vulnerable plugin API with API-key authentication enabled, particularly those relying on API keys for programmatic user management or third-party integrations.

Casky.ai maps this vulnerability to MITRE ATT&CK technique TA0004 (Privilege Escalation), with 224 skills capable of detecting the attack patterns. Practitioners using Casky would identify detection opportunities across multiple angles: authorization check bypasses in API controllers, scope validation failures in permission enforcement logic, and privilege elevation through invitation acceptance workflows. Claude's extended reasoning capabilities enable practitioners to trace the full attack chain—from initial least-privilege API key creation through scope enforcement gaps to the final privilege escalation—allowing security teams to identify not just vulnerable code patterns but also the behavioral indicators of attempted exploitation, such as anomalous invitation creation with elevated flags or unexpected admin account provisioning from restricted API operations.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-72828.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-72828

Casky has 224 skills that investigate the attack patterns behind CVE-2026-72828. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn