CVE-2026-72830

EUVD-2026-58644
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.custom_jobs that execute via Symfony Process for remote code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
getgravgrav
𝑥
< 1.0.13
CNA
Common Weakness Enumeration
References
https://github.com/getgrav/grav/security/advisories/GHSA-2x29-3mjq-2pvx
https://www.vulncheck.com/advisories/grav-api-plugin-before-rce-via-configcontroller-scope-bypass
https://github.com/getgrav/grav/security/advisories/GHSA-2x29-3mjq-2pvx