Is CVE-2026-72830 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72830?

CVE-2026-72830 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-72830

Description

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.custom_jobs that execute via Symfony Process for remote code execution.