CVE-2026-65897 is an improper privilege management vulnerability in the Grav API Plugin. Specifically, versions before 1.0.10 do not properly validate the groups field in InvitationsController::create(), enabling authenticated users with api.users.write permission to create invitation records that assign elevated group memberships. When these invitations are accepted, the invited accounts inherit super-admin API permissions, bypassing intended access controls.

An attacker with authenticated api.users.write access can escalate privileges by creating invitations that assign super-admin API permissions to new accounts. This leads to unauthorized full administrative API access, potentially compromising the entire system's security and control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.0.10, upgrading to version 1.0.10 or later is likely recommended once confirmed by the vendor. Until then, restrict api.users.write permissions to trusted users only.