Critical Vulnerabilities in Grav Plugin Allow Privilege Escalation and RCE

Ciberseguridadlatam

Critical Vulnerabilities in Grav Plugin Allow Privilege Escalation and RCE

First seen 16 Aug 2026, 06:17 UTC • •69.8

Article Content

1 / 3

Browse articles

ThreatCluster •August 17, 2026 at 02:17 UTC

•CVE-2026-72829 allows privilege escalation via restricted API keys in Grav plugin.
•CVE-2026-72824 enables remote code execution due to improper permission checks.
•Both vulnerabilities are classified as critical, affecting Grav CMS installations.

Two critical vulnerabilities (CVE-2026-72829 and CVE-2026-72824) were discovered in the Grav plugin API, published on 2026-08-14. CVE-2026-72829 allows privilege escalation using restricted API keys, enabling the creation of super-admin accounts. CVE-2026-72824 permits remote code execution (RCE) due to a flawed permission check, exposing servers with specific Twig configurations. Organizations using the Grav CMS are at risk, particularly those relying on limited API key permissions. The vulnerabilities have been classified as critical by the National Vulnerability Database. Immediate action is recommended to mitigate potential exploitation. No patches have been reported yet, increasing the urgency for system administrators to secure their installations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 56d ago How this analysis works

Timeline

2026-08-14

CVE-2026-72829 published

A vulnerability in the Grav API plugin allows privilege escalation using limited API keys.

Ciberseguridadlatam

2026-08-14

CVE-2026-72824 published

A critical flaw in the Grav API plugin permits remote code execution due to poor permission checks.

Ciberseguridadlatam

Recent

Vulnerabilities disclosed

Both vulnerabilities pose significant risks to organizations using the Grav CMS, requiring immediate attention.

Ciberseguridadlatam

More articles in this cluster (2)

Threat Graph

8 entities, 10 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Zero-day Exploit
T1068 - Exploitation for Privilege Escalation

Vulnerability (2)

CVE-2026-72824
CVE-2026-72829

Weakness (2)

CWE-269 - Improper Privilege Management
CWE-862 - Missing Authorization

Affected Platform (2)

Grav
Twig

Relationships

CVE-2026-72824 targets Grav
CVE-2026-72824 targets Twig
CVE-2026-72829 targets Grav
CVE-2026-72829 targets Twig
Zero-day Exploit targets Grav
Zero-day Exploit targets Twig
T1068 - Exploitation for Privilege Escalation targets Grav
T1068 - Exploitation for Privilege Escalation targets Twig
CVE-2026-72824 related to CWE-269 - Improper Privilege Management
CVE-2026-72824 related to CWE-862 - Missing Authorization

Following this threat?

Track CVE-2026-72824 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…