CVE-2026-64852CWE-862broken-access-control

CVE-2026-64852

published August 19, 2026

CVSS
8.7
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00414 · 34.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-19T20:18Z
References (4)
https://github.com/getgrav/grav-plugin-api/commit/ed16f0aaa9b398c6f179fb8f51e0fa53e4ed8a30 · [email protected]https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.8 · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3 · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 AUG 16:00Z
    Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account
    cvelistv5