Article - ThreatCluster

Back Ciberseguridadlatam

Ciberseguridadlatam •Redacción CSL • August 16, 2026

# CVE-2026-72829: falla en plugin de Grav permite escalar privilegios con API keys restringidas Una llave con permisos limitados para gestión de usuarios puede crear cuentas super-admin sin restricciones — el defecto expone instalaciones corporativas que confían en el sistema de scopes. El plugin Grav API, componente utilizado para integrar el CMS Grav con servicios […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Grav Plugin Allow Privilege Escalation and RCE Two critical vulnerabilities (CVE-2026-72829 and CVE-2026-72824) were discovered in the Grav plugin API, published on 2026-08-14. CVE-2026-72829 allows privilege escalation using restricted API keys, enabling the creation of super-admin accounts. CVE-2026-72824 permits remote code execution (RCE) due to a flawed permission check, exposing servers with specific Twig configurations. Organizations using the Grav CMS are at risk, particularly those relying on limited API key permissions. The vulnerabilities have been classified as critical by the National Vulnerability Database. Immediate action is recommended to mitigate potential exploitation. No patches have been reported yet, increasing the urgency for system administrators to secure their installations. 2 sources 70

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)