CVE-2026-72826

CVE-2026-72826 is an authorization bypass in the getgrav plugin's API key creation endpoint. The mechanism is straightforward and severe: the createApiKey method validates that the caller possesses the baseline api.access scope, then accepts the new key's scope directly from the request payload with no validation that the requested permissions are bounded by what the caller themselves holds. This inverts the permission model — the grantor can mint credentials exceeding its own authority. The exploit is trivial: submitting an empty scopes array produces an unscoped key with no restrictions, effectively a super key. Any minimally privileged API key on a super account becomes a pivot to full compromise. This is not a novel flaw. The same authorization DNA — authentication present but delegation unbounded — appears in AWS IAM PassRole vulnerabilities, OAuth 2.0 token exchange without scope constraints, and Kubernetes RBAC RoleBinding escalation. The pattern persists because the fix (validating that requested permissions are a subset of caller's permissions) is boring and easy to skip, and only becomes visible when delegation is the feature being implemented. The empty-scopes-as-superkey mutation compounds the risk; when null or empty permission arrays collapse to unrestricted, exploitation becomes trivial. For defenders: first, determine whether any Grav installations run this plugin and audit existing API keys — any valid key is a potential escalation vector. Second, examine the plugin's scope validation architecture; if the implementation uses a self-referential permission check without subset validation, assume the vulnerability exists. Third, treat this as a class vulnerability when auditing other CMS plugin ecosystems — API key creation endpoints with similar subset-check gaps likely exist elsewhere. The EPSS score of 0.00302 underweights this: it models generic exploitability but not the compound probability of a plugin ecosystem where one vulnerable component serves as a trust broker for the entire CMS. The blast radius from a compromised key here reaches every downstream capability accepting these credentials, not just the plugin itself.

Reviewed through automated stages and approved by a human before publication.