CVE-2026-75836
Received Received - Intake

Grav API Plugin Menubar Action Authorization Bypass

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize(), the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only checks the baseline api.access permission and never evaluates the authorize field a plugin registered for that action. Any authenticated caller with api.access can therefore invoke a privileged menubar action directly, bypassing the intended authorization. No plugin bundled with core Grav currently registers a privileged authorize handler, so on a stock install the impact is latent; the flaw affects any first- or third-party plugin relying on the documented authorize semantics.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75836
EUVD
EUVD-2026-60600

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav-plugin-api to 1.0.14 (exc)
getgrav grav_plugin_api to 1.0.14 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.14 allows authenticated users with api.access permission to bypass authorization checks. The POST endpoint for menubar actions does not verify the authorize field registered by plugins, enabling privilege escalation if plugins rely on this field.

Detection Guidance

To detect this vulnerability, check the version of the Grav API plugin. If you are using getgrav/grav-plugin-api before version 1.0.14, the system is vulnerable. Run commands like 'composer show getgrav/grav-plugin-api' or check the plugin version in the Grav admin panel.

Impact Analysis

An attacker with api.access could exploit this to perform unauthorized actions through the menubar API endpoint. While core Grav plugins are not affected, third-party plugins using the authorize field for security could be compromised, leading to privilege escalation or unauthorized access.

Mitigation Strategies

Immediately update the Grav API plugin to version 1.0.14 or later. This version includes the fix for the missing authorization check in MenubarController::executeAction().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75836. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart