Executive brief
The Grav API Plugin, used to provide programmatic access to the Grav CMS, contains a flaw in how it handles user invitations. An attacker with basic user-management permissions can invite a new user and assign them to high-privilege groups, such as 'super-admin,' which they themselves do not belong to. This allows a low-level staff member to create a new account with full control over the website and its data.
Technical details
A privilege escalation vulnerability exists in the InvitationsController::create() method of the Grav API Plugin. While the controller correctly strips sensitive 'access' flags for non-super-admin callers, it fails to perform an equivalent check on the 'groups' field. An authenticated attacker with 'api.users.write' permissions can submit an invitation request containing arbitrary group names. When the invitation is accepted, the new account inherits the permissions of those groups, including 'api.super' if specified. This bypasses the security policy defined in the core account blueprints and is inconsistent with the stricter validation performed in the standard UsersController. The issue is resolved in version 1.0.10.
Affected products
- getgrav Grav API Plugin < 1.0.10
Timeline
- 2026-07-09: advisory: GitHub Security Advisory GHSA-m86m-jjcg-gcvv published
- 2026-07-23: disclosed: CVE-2026-65897 published to NVD
- 2026-07-23: patched: Fix released in version 1.0.10
References
- https://github.com/getgrav/grav/commit/345e79e3abf8c15f80e612a09f6643300071324b
- https://github.com/getgrav/grav/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd
- https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv
- https://www.vulncheck.com/advisories/grav-api-plugin-privilege-escalation-via-invitations-groups