CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-72826 — The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scop...

·Source: NIST NVD

Updated:

Executive Summary

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super

Analysis

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super account can submit an empty scopes array to mint an unscoped, full-access super key, bypassing scope restrictions (and enabling further chains such as configuration write to RCE). CVSS Score: 9.8. Published: 2026-08-14T12:16:45.780.

Indicators of Compromise (1)

CVE (1)
CVE-2026-72826
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 14, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-75094 — A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_...

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVE-2026-75094
NIST NVD
MEDIUMVulnerability

Stripe agrees $7bn takeover of AI firm OpenRouter - Bloomberg

Payments giant Stripe has struck a $7 billion deal to acquire AI gateway keeper OpenRouter, according to Bloomberg.

Finextra
MEDIUMVulnerability

Unleashing Hackers to Be the US Government's Bounty Hunters

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/unleashing-hackers-to-be-us-governments-bounty-hunters-image_small-9-a-32585.jpg" align=right hspace=4><b>Trump Presidential Memo a Risky Proposition for Corporations and the Internet</b><br>Even those who support a White House push to involve the private sector in offensive cyber operations against foreign online crime groups adm

Bank Info Security