CVE-2026-64852

HighCVSS 8.7

Published: 19/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Summary

Grav API Plugin prior to 1.0.8 intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.

Risk Assessment

A user with basic panel access can escalate privileges and gain administrative API access, potentially leading to unauthorized content changes.

Recommendation

Upgrade Grav API Plugin to version 1.0.8 or later.

Original NVD description (English source)

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.