External risk intelligence

Grav API Plugin Scheduler Configuration Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-72830

The vulnerability affects an API plugin for a web application. API endpoints and web plugins in CMS platforms are commonly deployed in internet-facing configurations to facilitate external integrations and remote management, making the attack surface reachable from the public internet in typical deployment scenarios.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a Grav API plugin could allow attackers to execute arbitrary commands by exploiting a flaw in how API key permissions are handled, potentially leading to system compromise. The main concern is to confirm if this plugin is in use and if it is exposed to external access.

Plugin flaw permits unauthorized command execution.
Matters if using Grav API for external integrations.
Confirm usage and exposure for risk assessment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by using a specially crafted API request. If an attacker possesses a limited API key with the ability to write scheduler configurations, they can bypass scope restrictions. This allows them to inject malicious commands into the scheduler's job settings, leading to the execution of arbitrary code on the server.

Limited API key with write access.
Injecting commands into scheduler configuration.
Remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject arbitrary commands into scheduler configuration. This could lead to unauthorized execution of code on the affected system, impacting service behavior and potentially exposing system data when an API key with `api.config.write` scope is present.

System scheduler configuration is at risk.
Scoped API keys could bypass scope checks.
Arbitrary command execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for the Grav CMS application and its plugins, potentially including application owners, platform engineers, and security operations, should address this critical vulnerability. The first practical step involves identifying all instances of the affected Grav API plugin, determining their exposure, and assessing business criticality to prioritize remediation efforts.

Application owners should prioritize remediation.
Verify plugin reachability and business criticality.
Plan and coordinate necessary updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Grav API plugin?

The Grav API plugin is a component for Grav, a flat-file Content Management System (CMS). It enables external systems to communicate with the CMS through an API, facilitating tasks like remote content management, system configuration, and data integration. Many users rely on this plugin to automate site updates or connect their Grav installation to external dashboards and management tools.

How does CVE-2026-72830 work?

This vulnerability involves improper privilege management, classified as CWE-269 (Improper Privilege Management). It occurs when the plugin fails to properly enforce security scopes on API keys. Because of this flaw, a key that should only have limited permissions can instead gain unauthorized access to update the system scheduler, allowing an attacker to inject malicious commands.

Do I need a specific API key to trigger this?

Yes. An attacker must possess an API key that has the 'api.config.write' scope enabled. Simply having access to the API or the web server is not enough to exploit the bug; the attacker must be able to use this specific permission to interact with the configuration controller. If no keys with 'api.config.write' scope exist, or if they are not exposed, the trigger path is significantly harder to complete.

Is this CVE a risk for my system?

According to Halo Surface Signal, this vulnerability is likely relevant to you if your API plugin is internet-facing. Because CMS API endpoints are often exposed to allow for remote integrations, they are frequently reachable from the public internet. If your Grav installation is accessible to the public, an attacker can attempt to reach the vulnerable endpoint to perform these unauthorized actions.

When should I update the Grav API plugin?

You should prioritize updating immediately. First, audit your infrastructure to identify every instance where the Grav API plugin is installed and determine which are internet-facing. Once you have a clear inventory, coordinate an update to version 1.0.13 or higher, which resolves the scope enforcement failure. This is a critical security measure to prevent potential remote code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.