CVE-2026-80204
Received Received - Intake

API Key Scope Bypass in Grav API Plugin

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin()/hasPermission() checks without a request parameter, it cannot enforce scopeAllows(). A caller holding a scoped API key may therefore see (and potentially edit) page permission fields beyond the scope granted to the key. The end-to-end write-time impact was not fully confirmed by the reporter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80204
EUVD
EUVD-2026-66395

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav_plugin_api to 1.0.18 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-80204 is an authentication bypass vulnerability in the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.18. The issue occurs in the injectSecurityTab() function of BlueprintController, which fails to enforce API key scope limitations. Instead of respecting the granted permissions of a scoped API key, the function performs raw permission checks (isSuperAdmin()/hasPermission()) without considering the request parameters. This allows a caller with a scoped API key to view and potentially edit page permission fields beyond their authorized scope.

Impact Analysis

If you use Grav with the API plugin before 1.0.18, an attacker with a scoped API key could escalate their privileges. They may access or modify page permissions outside their intended scope, leading to unauthorized changes in security settings. This could result in data exposure, unauthorized content edits, or further system compromise depending on the compromised permissions.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to sensitive data or system permissions. If exploited, it may lead to unauthorized data exposure, modification, or deletion, which are direct violations of data protection and privacy regulations. Organizations using affected Grav versions must address this flaw to maintain compliance.

Mitigation Strategies

Upgrade the Grav API plugin to version 1.0.18 or later to address the improper scope enforcement in the injectSecurityTab() function.

Review and restrict API key scopes to ensure they align with the intended permissions for each key.

Audit page permission fields to verify no unauthorized edits have occurred due to the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80204. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart