CVE-2026-65897 describes an improper privilege management vulnerability in the Grav API Plugin prior to version 1.0.10. The issue arises because the groups field in InvitationsController::create() is not properly validated. Authenticated users with api.users.write permission can exploit this to create invitation records assigning elevated group memberships that include api.super permissions. When the invitation is accepted, the invited account inherits super-admin API access, bypassing intended access controls.

Successful exploitation allows an attacker with limited authenticated API write permissions to escalate privileges by creating accounts with super-admin API access. This can lead to full control over the API, potentially compromising the entire Grav system's security and administrative functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.0.10, upgrading to version 1.0.10 or later is likely recommended once confirmed. Until then, restrict api.users.write permissions to trusted users only to reduce risk.