CVE-2026-65897Patch

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Full discourse1 post

DFIR Lab@DFIR_Lab91d
Patch
🚨 HIGH SEVERITY: CVE-2026-65897 (CVSS 8.8) Grav API Plugin <1.0.10 allows privilege escalation via unvalidated groups field. Authenticated attackers can grant super-admin API access through malicious invitations. Patch immediately to v1.0.10+ #CVE #PatchNow https://t.co/fBPufpegNn
Post summary
The tweet announces CVE-2026-65897 as a high‑severity privilege escalation flaw in Grav API Plugin and urges users to immediately patch to version 1.0.10+.
0000054
99 followersView on X

Explore more

Back to dashboard