CVE-2026-80203
Received Received - Intake

Grav Plugin API Privilege Escalation via API Key Scope Bypass

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80203
EUVD
EUVD-2026-66394

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-api to 1.0.18 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The getgrav/grav-plugin-api plugin before version 1.0.18 has a flaw in its API-key scope enforcement. The requireNotSuperTarget() function incorrectly checks if the acting account is a super-admin instead of verifying if the API key itself has super authority. This allows API keys with limited scope but belonging to super-admin accounts to perform actions like disabling 2FA, deleting avatars, or minting new API keys for other super-admin accounts.

Impact Analysis

If you use the affected plugin, an attacker with a limited-scope API key from a super-admin account could escalate privileges. They could disable security features like 2FA for other super-admins, delete their avatars, or create new API keys under their identity. This could lead to unauthorized access, data manipulation, or complete account takeover.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's access controls. It undermines user authentication and authorization mechanisms, potentially resulting in non-compliance with data protection and security standards.

Mitigation Strategies

Update the getgrav/grav-plugin-api plugin to version 1.0.18 or later to enforce proper API-key scope checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80203. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart