CVE-2026-72830
CriticalCVSS 9.8Summary
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.custom_jobs that execute via Symfony Process for remote code execution.
Risk Assessment
An attacker with a limited API key could gain full control of the server, potentially leading to system and data integrity compromise.
Recommendation
Update the Grav API plugin to version 1.0.13 or later. Review and restrict API key scopes.
Original NVD description (English source)
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.custom_jobs that execute via Symfony Process for remote code execution.