CVE-2026-65007
Received Received - Intake

Grav API Plugin Unauthorized API Key Generation and Privilege Escalation

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: VulnCheck

Description
The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-65007
EUVD
EUVD-2026-46182

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
grav grav-plugin-api to 1.0.8 (exc)
getgrav grav-plugin-api to 1.0.8 (exc)
getgrav grav-plugin-api 1.0.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65007 is a missing authorization vulnerability in the Grav API plugin (grav-plugin-api) before version 1.0.8. It allows any user with the basic admin.login permission to generate or revoke API keys for any account, including those with elevated privileges. The plugin fails to properly authorize these actions, enabling unauthorized key creation tied to any user account. The forged API key inherits the target account's permissions, allowing persistent impersonation and privilege escalation.

Detection Guidance

Check Grav plugin versions using commands like 'bin/grav plugin list' or 'composer show grav-plugin-api'. Look for versions before 1.0.8. Inspect API key generation logs for unauthorized requests to endpoints like '/apiKeyGenerate' or '/apiKeyRevoke'.

Impact Analysis

This vulnerability enables account impersonation and privilege escalation up to full account takeover. Attackers can create persistent API keys bound to any account, inheriting its permissions. If an API-enabled account has broader permissions, attackers can escalate privileges or impersonate users, leading to unauthorized access and control over the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's principles of data protection and user consent. For HIPAA, it risks exposing protected health information by allowing privilege escalation and account takeover through forged API keys.

Mitigation Strategies

Upgrade the grav-plugin-api to version 1.0.8 or later immediately. Review all API keys for suspicious activity and revoke any unauthorized keys. Restrict admin.login permissions to only necessary users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65007. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart