CVE-2026-72823— Grav before 1.0.13 API-key scope cap bypass via DemoController
Quick assessment
Affected
getgrav grav
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Grav是Grav组织开源的一款基于文件的扁平化内容管理系统。 Grav1.0.13之前版本存在授权问题漏洞，该漏洞源于DemoController中存在API密钥作用域上限绕过，其requireSuper()方法在调用requirePermission()之前检查isSuperAdmin()并提前返回，导致api_key_scopes上限被跳过，攻击者利用超级账户创建的受限API密钥可绕过作用域限制调用baseline()和reset()操作，捕获演示基线或强制重置演示。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-72823
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Grav before 1.0.13 API-key scope cap bypass via DemoController
Source: CVE Program / CVE List V5
Vulnerability Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks isSuperAdmin() and returns early before invoking requirePermission(), so the api_key_scopes cap (enforced only in requirePermission()) is skipped. As a result, any scoped API key minted on a super account can bypass its scope restrictions when calling the baseline() and reset() operations (e.g. POST /api/v1/demo/reset), allowing it to capture the demo baseline or force a demo reset. Impact is bounded to demo-engine control and is conditional on demo mode being configured with writable resources.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Grav 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Grav是Grav组织开源的一款基于文件的扁平化内容管理系统。 Grav1.0.13之前版本存在授权问题漏洞，该漏洞源于DemoController中存在API密钥作用域上限绕过，其requireSuper()方法在调用requirePermission()之前检查isSuperAdmin()并提前返回，导致api_key_scopes上限被跳过，攻击者利用超级账户创建的受限API密钥可绕过作用域限制调用baseline()和reset()操作，捕获演示基线或强制重置演示。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-72823
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-72823
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-72823 (2)
Same Patch Batch · getgrav · 2026-08-14 · 15 CVEs total
| CVE-2026-72824 | 8.8 HIGH | Grav before 1.0.13 API Key Scope Bypass via PagesController |
| CVE-2026-72826 | 8.8 HIGH | Grav before 1.0.13 Scope Bypass via createApiKey |
| CVE-2026-72819 | 8.8 HIGH | Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload |
| CVE-2026-72831 | 8.8 HIGH | Grav through 2.0.11 Authentication Bypass via Flex Objects |
| CVE-2026-72822 | 8.8 HIGH | Grav before 1.0.13 Authentication Bypass via disable2fa |
| CVE-2026-72830 | 8.8 HIGH | Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass |
| CVE-2026-72833 | 8.8 HIGH | Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys |
| CVE-2026-72829 | 8.8 HIGH | Grav before 1.0.13 API Key Scope Bypass via UsersController |
| CVE-2026-72827 | 8.8 HIGH | Grav CMS before 2.0.13 Remote Code Execution via Twig |
| CVE-2026-72825 | 7.6 HIGH | Grav before 1.0.13 API-key scope cap bypass via ReportsController |
| CVE-2026-72828 | 7.2 HIGH | Grav before 1.0.13 API Key Scope Bypass via InvitationsController |
| CVE-2026-72821 | 5.4 MEDIUM | Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle |
| CVE-2026-72832 | 5.4 MEDIUM | Grav before 2.0.12 Stored XSS via quoted-attribute bypass |
| CVE-2026-72820 | 4.9 MEDIUM | Grav 2.0.11 Path Traversal via Backup Profile Configuration |
IV. Related Vulnerabilities
Same product: grav
-
CVE-2026-100670
Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blue -
CVE-2026-100671
Grav before 2.0.25 Session Cookie Theft via Twig Sandbox -
CVE-2026-100669
Grav before 2.0.25 Sensitive File Disclosure via Case-Variat -
CVE-2026-100668
Grav before 2.0.25 Sandbox Escape via array Filter -
CVE-2026-100667
grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authenticat
Same vendor: getgrav
-
CVE-2026-100673
Grav Data Manager before 1.4.5 Stored XSS via item-detail vi -
CVE-2026-100672
grav-plugin-comments before 1.2.11 Unauthenticated Informati -
CVE-2026-100671
Grav before 2.0.25 Session Cookie Theft via Twig Sandbox -
CVE-2026-100670
Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blue -
CVE-2026-100669
Grav before 2.0.25 Sensitive File Disclosure via Case-Variat
Same weakness: CWE-862
-
CVE-2026-88999
Redux Framework <= 4.5.14 - Missing Authorization to Authent -
CVE-2026-76147
Genians, Inc Genian NAC/ZTNA Remote Code Execution -
CVE-2026-76143
Genians, Inc Genian SSL PNS Multi Factor Authentication Bypa -
CVE-2026-92245
Simply Schedule Appointments <= 1.6.12.32 - Missing Authoriz -
CVE-2026-101879
OpenClaw Windows Node before 2026.7.1-3 Missing Authorizatio
V. Comments for CVE-2026-72823
No comments yet