CVE-2026-62667
Received Received - Intake

Grav API Plugin Privilege Escalation via Scope Misconfiguration

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the owning user's complete identity. AbstractApiController::requirePermission() consequently evaluates the full user ACL, so a key issued for a read-only scope can perform every write, delete, and administrative operation available to the owner. This issue is fixed in version 1.0.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-62667
EUVD
EUVD-2026-62541

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav-plugin-api to 1.0.6 (inc)
getgrav grav-plugin-api to 1.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in the Grav API Plugin (versions before 1.0.6) involves improper enforcement of API key scopes. API keys are supposed to restrict access based on declared permissions (e.g., read-only), but the authentication system ignores these scopes and grants full user privileges instead. This allows keys with limited scopes to perform unauthorized write, delete, or administrative actions.

Detection Guidance

Check the installed version of the Grav API plugin using Composer: composer show getgrav/grav-plugin-api. If the version is 1.0.5 or below, the system is vulnerable. Review API key configurations in Grav admin panel to verify if keys have scopes assigned but still allow unauthorized actions.

Impact Analysis

This vulnerability can lead to unauthorized access and manipulation of your Grav CMS content. Attackers could exploit it to modify, delete, or perform administrative actions even with a read-only scoped API key. This undermines data integrity and confidentiality, potentially causing data loss or unauthorized changes.

Compliance Impact

This vulnerability can violate compliance requirements like GDPR and HIPAA by allowing unauthorized access to sensitive data. It undermines least-privilege principles and access controls, which are critical for maintaining data protection standards. Organizations using affected versions may face compliance violations and increased risk of data breaches.

Mitigation Strategies

Upgrade the Grav API plugin to version 1.0.6 or later immediately. Revoke all existing API keys and regenerate them with proper scopes after updating. Audit user permissions and API key usage to ensure least privilege is enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart