CVE-2026-62666
Received Received - Intake

API Key Privilege Escalation in Grav API Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApiKeyPermission(), obtain the target's full privileges because key scopes are not enforced, and create persistent super-administrator access; the same missing check also permits rotating or disabling the target's two-factor authentication. This issue is fixed in version 1.0.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-62666
EUVD
EUVD-2026-62539

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-api 1.0.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Grav API Plugin (versions prior to 1.0.6) allows non-super users with api.users.write permission to escalate privileges. By exploiting missing authorization checks in UsersController::createApiKey(), generate2fa(), and disable2fa() endpoints, they can mint API keys bound to super-admin accounts, bypassing scope enforcement and gaining full administrative access. The issue also permits disabling two-factor authentication for super-admins without credentials.

Detection Guidance

Check Grav CMS plugin versions using commands like 'composer show grav-plugin-api' or inspecting the plugin directory for version 1.0.6 or higher. Review API key permissions and user roles for unauthorized super-admin access or API key minting.

Impact Analysis

If you use Grav CMS with the API plugin before version 1.0.6, an attacker with api.users.write access could gain full control of your Grav instance. This includes creating persistent super-administrator access, disabling security measures like 2FA, and potentially taking over your entire site. The impact is severe as it allows complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's integrity and confidentiality principles and HIPAA's security requirements. Unauthorized privilege escalation may result in unauthorized data exposure, access, or modification, leading to compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade the Grav API plugin to version 1.0.6 or later. Audit existing API keys and user roles to remove any unauthorized super-admin access or keys minted by non-super users. Disable or restrict api.users.write permissions where possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62666. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart