CVE-2026-65897

highCVSS 8.8covered by 1 sourcefirst seen 2026-07-23

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.

⚡ Watch CVE-2026-65897

Get an email if CVE-2026-65897 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-65897: Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsControl…nvd · 2026-07-23

External references

NVD record for CVE-2026-65897

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-65897 status](https://www.csirts.com/badge/CVE-2026-65897)](https://www.csirts.com/cve/CVE-2026-65897)