CVE-2026-64852
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content.
Impact
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/getgrav/grav-plugin-api/commit/ed16f0aaa9b398c6f179fb8f51e0fa53e4ed8a30
- https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.8
- https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3
- https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3