CVE-2026-64852

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.

Affected Software

Weaknesses

• CWE-862: CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

Additional References

• https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3

References

• https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3
• https://github.com/getgrav/grav-plugin-api/commit/ed16f0aaa9b398c6f179fb8f51e0fa53e4ed8a30
• https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.8

• ←Previous
• Next→