CVE-2026-62233
HIGH
CVSS 8.7
grav
Verified Advisory
Privilege escalation in Grav Plugin API (CVE-2026-62233)
grav-plugin-api fails to validate super-admin status in the createApiKey, generate2fa, and disable2fa endpoints, representing an incomplete fix of GHSA-p97c-g455-q447. A non-super api.users.write manager can exploit these unguarded endpoints to mint API keys bound to super-admin accounts or strip 2FA from super-admin users, achieving full instance takeover.
Affected versions:
- <= 1.0.5
We recommend updating to: 1.0.6.
CVSS 8.7 · our assessment: this_week
Vendor advisory: https://github.com/getgrav/grav/security/advisories/GHSA-8gg4-rvvv-cq96
Details: https://vuln.today/cve/CVE-2026-62233
Verified by vuln.today against published advisories.
Affected versions
- – <= 1.0.5
Fixed in: 1.0.6
More advisories for grav
- CVE-2026-62230 – Case-sensitive extension filtering bypass in Grav CMS (CVE-2026-62230)
- CVE-2026-62231 – Authorization bypass in Grav API plugin (CVE-2026-62231)
- CVE-2026-62232 – Two-factor authentication bypass in Grav CMS (CVE-2026-62232)
- CVE-2026-62234 – Server-Side Request Forgery in Grav CMS (CVE-2026-62234)
- CVE-2026-62386 – JWT token exposure in URL parameters in Grav API plugin (CVE-2026-62386)
- CVE-2026-62387 – Overly permissive CORS in Grav API plugin (CVE-2026-62387)