CVE-2026-65007
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Grav api plugin (grav-plugin-api) before version 1.0.8 fails to properly authorize API key generation and revocation. It intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover.
Risk Assessment
The organization risks that any Grav admin panel user (even with low privileges) can generate an API key for a higher-privileged account and take over that account, potentially leading to unauthorized access to data and administrative functions.
Recommendation
Update the Grav api plugin to version 1.0.8 or later. Review existing API keys and revoke any unauthorized ones.
Original NVD description (English source)
The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover.