CVE-2026-75835
Received Received - Intake

Missing Authorization in Grav API Plugin

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a result, an authenticated attacker holding a scoped API key minted on a privileged account can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions (sidebar/menubar/widget items and users-list columns/row-actions/filter-tabs) that their key scope should deny, resulting in information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75835
EUVD
EUVD-2026-60599

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-api to 1.0.14 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization flaw in the Grav API plugin before version 1.0.14. The userPassesAuthorize() function fails to check API key scopes properly, relying instead on the account's super-admin status and ACL grants. This allows attackers with scoped API keys to bypass restrictions and access unauthorized UI metadata and item definitions.

Detection Guidance

Check Grav plugin versions with: grep -r 'grav-plugin-api' /path/to/grav/installation. Verify if version is below 1.0.14. Inspect AbstractApiController.php for userPassesAuthorize() function usage without scope checks.

Impact Analysis

An authenticated attacker with a scoped API key from a privileged account could access unauthorized UI elements like sidebar items, menubar widgets, user list columns, row actions, and filter tabs. This results in potential information disclosure, exposing sensitive data or system configurations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive UI metadata and item definitions, potentially exposing personal or confidential data. For GDPR, this may result in unauthorized data disclosure violating principles of data protection and user consent. For HIPAA, it could risk exposing protected health information if user lists or related metadata are accessed without proper authorization.

Mitigation Strategies

Update Grav API plugin to version 1.0.14 or later immediately. Review API key scopes for privileged accounts and ensure they are properly restricted. Monitor for unauthorized access to UI metadata or listings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75835. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart