Grav CMS: Eleven Vulnerabilities Disclosed, Including Critical API Privilege Escalation
Grav CMS and plugins hit by 11 vulnerabilities on Aug 14, 2026, including critical privilege escalation and RCE flaws.
Key findings
- Eleven vulnerabilities disclosed for Grav CMS and plugins on August 14, 2026.
- Critical and High severity flaws in Grav API plugin allow privilege escalation and scope bypass.
- Flex Objects plugin vulnerable to incorrect authorization and remote code execution via crafted ZIP uploads.
- Stored XSS in Grav Form plugin affects users viewing forms with crafted option labels.
- Grav CMS core affected by path traversal in backup profiles.
- Patches available in Grav API plugin 1.0.13, Grav CMS 2.0.13, and Form plugin 9.1.15.
On August 14, 2026, a significant batch of eleven vulnerabilities was disclosed for the Grav CMS and its associated plugins, with a critical severity rating of 9.8 and high ratings up to 8.8. These vulnerabilities, primarily affecting the Grav API plugin (getgrav/grav-plugin-api) and the Flex Objects plugin, expose users to risks including privilege escalation, authorization bypass, and remote code execution. The disclosures highlight systemic issues in how API key scopes and user permissions are managed within the Grav ecosystem.
Several critical and high-severity vulnerabilities center on the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.13. These include privilege escalation flaws where API key scope limitations are bypassed, allowing lower-privileged keys to perform actions reserved for super-admins. CVE-2026-72833, CVE-2026-72829, CVE-2026-72828, CVE-2026-72826, CVE-2026-72825, and CVE-2026-72822 all detail variations of these scope-cap bypasses across different controllers and endpoints, such as user creation/updates, invitation handling, and disabling two-factor authentication. CVE-2026-72826 specifically points to an issue in createApiKey where scopes are not validated against the caller's permissions.
The Flex Objects plugin is also implicated, with CVE-2026-72831 detailing an incorrect authorization vulnerability where the plugin's API fails to enforce specific permissions beyond general directory access. Furthermore, CVE-2026-72819, a high-severity remote code execution vulnerability, arises from improper validation in the Flex Objects plugin's settings, allowing authenticated users to upload ZIP files containing PHP code by exploiting array notation bypasses.
Other vulnerabilities include a stored cross-site scripting (XSS) flaw in the Grav Form plugin (CVE-2026-72821), where malicious HTML and script payloads can be injected into radio and toggle field option labels, affecting users and administrators viewing the forms. Additionally, Grav CMS versions before 2.0.13 are affected by CVE-2026-72820, a medium-severity vulnerability allowing attackers with profile editor access to archive sensitive directories outside the intended backup scope due to improper validation of backup profile root paths.
The majority of these vulnerabilities, particularly those in the Grav API plugin, were patched in version 1.0.13. The Flex Objects plugin was affected through version 1.4.6, and Grav CMS itself was patched in version 2.0.13. Users are strongly advised to update to the latest versions to mitigate these risks.
This coordinated disclosure of multiple, severe vulnerabilities underscores the importance of timely patching and vigilant security practices for Grav CMS users. The breadth of issues, from API permission bypasses to RCE and XSS, highlights potential attack vectors that could compromise sensitive data and system integrity. Administrators should prioritize updating the core CMS and all plugins to secure their installations against these newly revealed threats.