Grav API Plugin Scope Bypass Enables Privilege Escalation

The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin()-gated write endpoints (in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController). These endpoints authorize via a super-admin early-return that never invokes requirePermission()—the sole enforcement point of the scope cap—so a 'read-only'-scoped key (e.g. api.pages.read) can perform super-only write operations, including rewriting group ACL maps to grant super-admin privileges to arbitrary accounts. A leaked or delegated read-only CI/monitoring key can therefore gain full super-admin write capability. Fixed in 1.0.13.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Grav API plugin versions 1.0.6 through 1.0.11 contain a critical privilege escalation flaw where scoped API keys fail to enforce their declared permission boundaries on four sensitive administrative endpoints. When a scoped API key is created from a super-admin account, it should be restricted by its declared scope cap; however, four endpoints in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController implement early-return authorization checks that bypass the requirePermission() enforcement point entirely. This allows an attacker with a limited-scope API key to perform unauthorized administrative write operations, effectively escalating privileges beyond the intended scope. Organizations running Grav CMS with the API plugin in this version range face immediate risk if they have issued scoped API keys for delegated access or third-party integrations.

Casky's 224 mapped security skills leverage Claude's extended reasoning to detect the authorization bypass patterns underlying CWE-269 (Improper Access Control). Practitioners using Casky would identify this vulnerability through detection of Privilege Escalation (MITRE ATT&CK TA0004) techniques by observing: (1) API authentication logs showing scoped key usage followed by unauthorized administrative actions on protected endpoints, (2) code-level findings revealing authorization logic that returns early without invoking permission enforcement functions, and (3) behavioral anomalies where API keys with declared read-only or limited scopes execute write operations on sensitive resources like user groups or system preferences. The platform's Claude-powered analysis would flag the mismatch between declared API scope and actual endpoint access, enabling rapid identification of both the vulnerability and active exploitation attempts before privilege escalation is weaponized at scale.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-72833.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-72833

Casky has 224 skills that investigate the attack patterns behind CVE-2026-72833. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn