High severity · published Jul 23, 2026
CVE-2026-65897
Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav · getgrav
before 1.0.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-65897
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-65897
github.com
https://github.com/getgrav/grav-plugin-api/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd
github.com
https://github.com/getgrav/grav/commit/345e79e3abf8c15f80e612a09f6643300071324b
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv
www.vulncheck.com
https://www.vulncheck.com/advisories/grav-api-plugin-privilege-escalation-via-invitations-groups
More from grav
9.9
CVE-2024-34082
Grav is a file-based Web platform
9.8
CVE-2026-80203
Grav before 1.0.18 Authentication Bypass via Scoped API Key
9.8
CVE-2026-56710
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
9.8
CVE-2026-65008
Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
9.8
CVE-2021-47812
GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)