Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: getgrav grav 1.0.13 Clear all filters
TI-2026-51056 CVE-2026-72830 · GHSA-q6cm-x4f7-73r6

Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass

Priority HIGH 79

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00742 Published 2026-08-14 Fixed in 1.0.13 CWE-269
TI-2026-51055 CVE-2026-72829 · GHSA-prpx-fhmf-2g8p

Grav before 1.0.13 API Key Scope Bypass via UsersController

Priority HIGH 79

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00469 Published 2026-08-14 Fixed in 1.0.13 CWE-269
TI-2026-51050 CVE-2026-72824 · GHSA-qpvv-mv8x-vg3c

Grav before 1.0.13 API Key Scope Bypass via PagesController

Priority HIGH 79

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent().

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00727 Published 2026-08-14 Fixed in 1.0.13 CWE-862
TI-2026-51048 CVE-2026-72822 · GHSA-993x-642g-h4x5

Grav before 1.0.13 Authentication Bypass via disable2fa

Priority MEDIUM 46

The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00555 Published 2026-08-14 Fixed in 1.0.13 CWE-306