CVE-2026-65897 HIGH

CVE-2026-65897: Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

Vendor Getgrav

Product grav

Weakness CWE-269

Published July 23, 2026

Last update July 24, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.

Key dates

02Disclosure timeline

July 23, 2026 CVE published

July 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-65897 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/269.html AskarLabs — CWE-269 write-up Improper Privilege Management

Related vulnerabilities

04Related CVE

CVE-2026-2931 Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change CVE-2026-7284 Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register CVE-2025-12882 Clasifico Listing <= 2.0 - Unauthenticated Privilege Escalation CVE-2026-7641 Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields CVE-2026-7467 Read More & Accordion <= 3.5.7 - Privilege Escalation via importData