CVE-2026-72830 affects Grav API plugin versions prior to 1.0.13. The vulnerability arises because the ConfigController super-scope gates fail to enforce API key scope caps properly. As a result, attackers possessing a scoped api.config.write key can write to scheduler configuration, specifically injecting commands into scheduler.custom_jobs. These commands are executed by the Symfony Process component, enabling remote code execution on the affected system. The CVSS 4.0 base score is 9.3, reflecting a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected system without requiring privileges or user interaction. This can lead to full system compromise, data loss, or service disruption due to the ability to inject and execute scheduler jobs via the Grav API plugin.

A fixed version 1.0.13 or later should be applied to address this vulnerability. Since no official remediation level or patch link is provided, users should verify with the vendor or official Grav project resources for the availability of an official fix. Until patched, restrict or revoke api.config.write scoped keys to untrusted users to prevent exploitation.