CVE-2026-64852
Received Received - Intake

Stored XSS in Grav API Plugin for Grav CMS

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-64852
EUVD
EUVD-2026-62550

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
getgrav grav_plugin_api to 1.0.8 (exc)
getgrav grav_plugin_api to 1.0.7 (exc)
grav api_plugin to 1.0.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Grav API Plugin for Grav CMS before version 1.0.8. A basic panel user can exploit it to generate or revoke API keys for other accounts, including those with higher privileges. The forged API key inherits the target account's permissions, allowing unauthorized access and privilege escalation.

Detection Guidance

Check Grav CMS plugin API version. If using version below 1.0.8, the system is vulnerable. Inspect api.php for unauthorized API key generation or revocation attempts targeting other accounts.

Impact Analysis

An attacker with basic access could take over accounts with broader API permissions, leading to data theft, unauthorized modifications, or full system compromise. Persistent API keys enable long-term impersonation and potential data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It undermines access controls and audit trails, increasing compliance risks for affected organizations.

Mitigation Strategies

Update Grav API plugin to version 1.0.8 or later. Verify only users with admin.users or admin.super permissions can manage API keys for other accounts. Restrict super-admin API key management to super-admins only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64852. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart