CVE-2026-65897 | Grav API Plugin versions before 1.0.10 fail to validate the … | CVSS 8.8 HIGH

Description

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.

Metadata

CVE ID: CVE-2026-65897
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-23 11:03 UTC
Published: 2026-07-23 11:42 UTC
Last updated: 2026-07-24 21:35 UTC
Primary CWE: CWE-269
Improper Privilege Management
Vendor / Product: getgrav / grav
Sources: cve.org · NVD

Severity & Metrics

8.8 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
getgrav	grav	—	0 < 1.0.10, 1.0.10

Weakness (CWE)

CWE	Source	Description
CWE-269	cna	Improper Privilege Management

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.8	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (4)

GitHub Security Advisory (GHSA-m86m-jjcg-gcvv) https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv
Patch Commit https://github.com/getgrav/grav/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd
Patch Commit https://github.com/getgrav/grav/commit/345e79e3abf8c15f80e612a09f6643300071324b
VulnCheck Advisory: Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups https://www.vulncheck.com/advisories/grav-api-plugin-privilege-escalation-via-invitations-groups