API Key Scope Validation Bypass in Grav Plugin

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a result, an api.users.write-scoped key minted on a super account can set access.api.super or assign a super-granting group to mint or promote a full super account, then authenticate as that account for uncapped administrative privileges.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Grav API plugin before version 1.0.13 contains a critical privilege escalation vulnerability where API key scope restrictions are improperly enforced during user creation and modification operations. Specifically, the UsersController's create() and update() methods validate scope caps for api.users.write permissions but fail to apply the same validation when granting super-administrator privileges. An attacker with a restricted api.users.write-scoped API key generated from a super-administrator account can exploit this gap to directly set super-admin access or assign users to super-granting groups, effectively escalating from limited write permissions to full administrative control. This affects any organization running Grav CMS with the vulnerable API plugin enabled, particularly those managing multi-tenant or delegated administration scenarios where API keys with limited scopes are distributed to third parties or automation systems.

Casky's 224 mapped security skills detect the attack patterns underlying this vulnerability by analyzing Privilege Escalation (TA0004) techniques through extended reasoning across multiple vectors. Practitioners using Casky would identify findings related to improper authorization checks, specifically detecting where scope validation logic is inconsistently applied across different code paths—in this case, the presence of isSuperAdmin() checks that bypass scope-cap enforcement. The platform's Claude-powered analysis would flag the discrepancy between restrictive validation on write operations versus permissive checks on privilege grants, revealing the logical gap an attacker exploits. Security teams would see recommendations to implement consistent scope validation layers, enforce scope checks before any privilege assignment, and audit API key usage patterns for instances where limited-scope keys are performing administrative actions—enabling rapid detection and remediation before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-72829.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-72829

Casky has 224 skills that investigate the attack patterns behind CVE-2026-72829. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn