CVE-2026-80203

CriticalCVSS 9.8

Published: 26/08/2026(UTC)Updated: 03/09/2026(UTC)Translated: 26/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

32th percentile - higher than 32% of all known CVEs

Summary

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.

Risk Assessment

A person with an API key of limited scope but belonging to a super-admin account can take over other super-admin accounts, leading to security and integrity breach.

Recommendation

Upgrade the getgrav/grav-plugin-api plugin to version 1.0.18 or later, which includes the fix. Review and restrict API key scopes.

Other vulnerabilities in getgrav/grav-plugin-api

CVE-2026-72825High
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of requireSuper(). Because isSuperAdmin() reads access.api.super directly and never consults api_key_scopes, a least-privilege API key scoped to api.config.write minted on a super account passes the gate, allowing an attacker to append attacker-chosen tokens to the security.twig_sandbox allowlist (persisted to user/config/security.yaml). Widening the allowlist turns any subsequent Twig-in-content render into an SSTI/RCE sink.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS