CVE-2026-75835 - Grav API Plugin before 1.0.14 Missing Authorization

Back Back to CVE browser

CRITICAL

Grav API Plugin before 1.0.14 Missing Authorization

Published Aug 18, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 0.31%

Description

Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a result, an authenticated attacker holding a scoped API key minted on a privileged account can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions (sidebar/menubar/widget items and users-list columns/row-actions/filter-tabs) that their key scope should deny, resulting in information disclosure.

Affected products

Vendor Getgrav Product Grav Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.0.14
- Version
  1.0.14
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Getgrav

Grav

unaffected

Version	Status	Constraints
0	affected	<1.0.14
1.0.14	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60599
Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-p57v-xhv3-mf2w
exploitvendor-advisory
https://www.vulncheck.com/advisories/grav-api-plugin-before-missing-authorization
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60599		Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-p57v-xhv3-mf2w		exploitvendor-advisory
https://www.vulncheck.com/advisories/grav-api-plugin-before-missing-authorization		third-party-advisory