CVE-2026-65897

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65897", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-23T11:03:13.092Z", "datePublished": "2026-07-23T11:42:17.453Z", "dateUpdated": "2026-08-28T15:18:30.122Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-28T15:18:30.122Z"}, "datePublic": "2026-07-09T00:00:00.000Z", "title": "Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups", "descriptions": [{"lang": "en", "value": "Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Privilege Management", "cweId": "CWE-269", "type": "CWE"}]}], "affected": [{"vendor": "getgrav", "product": "grav", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.0.10"}, {"version": "1.0.10", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.10"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv", "name": "GitHub Security Advisory (GHSA-m86m-jjcg-gcvv)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/getgrav/grav-plugin-api/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/getgrav/grav/commit/345e79e3abf8c15f80e612a09f6643300071324b", "name": "Patch Commit", "tags": ["patch"]}, {"name": "VulnCheck Advisory: Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/grav-api-plugin-privilege-escalation-via-invitations-groups"}], "credits": [{"lang": "en", "value": "izumi-hyun", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T15:24:56.000746Z", "id": "CVE-2026-65897", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T15:26:05.842Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-65897", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-23T15:24:56.000746Z"}}}], "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T15:25:58.161Z"}}], "cna": {"title": "Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups", "credits": [{"lang": "en", "type": "reporter", "value": "izumi-hyun"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.10", "versionType": "semver"}, {"status": "unaffected", "version": "1.0.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-07-09T00:00:00.000Z", "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv", "name": "GitHub Security Advisory (GHSA-m86m-jjcg-gcvv)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/getgrav/grav-plugin-api/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/getgrav/grav/commit/345e79e3abf8c15f80e612a09f6643300071324b", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/grav-api-plugin-privilege-escalation-via-invitations-groups", "name": "VulnCheck Advisory: Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "Improper Privilege Management"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-28T15:18:30.122Z"}}}, "cveMetadata": {"cveId": "CVE-2026-65897", "state": "PUBLISHED", "dateUpdated": "2026-08-28T15:18:30.122Z", "dateReserved": "2026-07-23T11:03:13.092Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-07-23T11:42:17.453Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "grav", "vendor": "getgrav", "versions": [{"lessThan": "1.0.10", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.0.10", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions."}, {"lang": "es", "value": "Las versiones del Plugin de API de Grav anteriores a la 1.0.10 no validan el campo groups en InvitationsController::create(), permitiendo que los llamadores autenticados de api.users.write asignen cuentas invitadas a grupos que otorgan permisos api.super. Los atacantes pueden crear registros de invitaci\u00f3n con membres\u00eda de grupo elevada, y cuando se acepta, la nueva cuenta obtiene acceso completo de superadministrador a la API sin que el invitador posea esos permisos."}], "id": "CVE-2026-65897", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65897", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-23T15:24:56.000746Z", "version": "2.0.3"}}]}, "published": "2026-07-23T12:18:48.180", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/getgrav/grav-plugin-api/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/getgrav/grav/commit/345e79e3abf8c15f80e612a09f6643300071324b"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/grav-api-plugin-privilege-escalation-via-invitations-groups"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/getgrav/grav/security/advisories/GHSA-m86m-jjcg-gcvv"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.0.10"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "grav", "vendor": "getgrav"}], "created": "2026-07-23T18:15:12.810492+00:00", "updated": "2026-08-03T21:45:03.273961+00:00", "vendors": ["getgrav", "getgrav$PRODUCT$grav"]}