Authorization bypass in Grav API plugin (CVE-2026-62231)

The Grav API plugin (getgrav/grav-plugin-api) contains an authorization bypass in which API keys created with a restricted scopes array are never enforced by the ApiKeyAuthenticator class. The authenticator loads and returns the owning user's full account object without consulting the key's declared scopes, meaning any API key carries the full privileges of the owning account regardless of how it was scoped. A key created with read-only scopes can therefore perform any write, delete, or administrative operation that the owning user is authorized to perform. Affected versions: - 1.0.5 We recommend updating to: 1.0.6. CVSS 8.6 · our assessment: this_week Vendor advisory: https://github.com/getgrav/grav/security/advisories/GHSA-x7hm-jc32-v39j Details: https://vuln.today/cve/CVE-2026-62231