CVE-2026-62233
HIGH
CVSS 8.7
grav
Verified Advisory
Privilege escalation in Grav Plugin API (CVE-2026-62233)
grav-plugin-api fails to validate super-admin status in the createApiKey, generate2fa, and disable2fa endpoints, representing an incomplete fix of GHSA-p97c-g455-q447. A non-super api.users.write manager can exploit these unguarded endpoints to mint API keys bound to super-admin accounts or strip 2FA from super-admin users, achieving full instance takeover.
Affected versions:
- <= 1.0.5
We recommend updating to: 1.0.6.
CVSS 8.7 · our assessment: this_week
Vendor advisory: https://github.com/getgrav/grav/security/advisories/GHSA-8gg4-rvvv-cq96
Details: https://vuln.today/cve/CVE-2026-62233
Verified by vuln.today against published advisories.
Affected versions
- – <= 1.0.5
Fixed in: 1.0.6
More advisories for grav
- CVE-2026-65608 – Remote code execution in Grav CMS via unchecked callable in FlexDirectory (CVE-2026-65608)
- CVE-2026-65895 – Broken access control in Grav API Plugin configuration scopes (CVE-2026-65895)
- CVE-2026-65896 – Path traversal in Grav API Plugin POST /pages/{route}/move endpoint (CVE-2026-65896)
- CVE-2026-65897 – Privilege escalation via unvalidated groups field in Grav API Plugin (CVE-2026-65897)
- CVE-2026-65603 – Privilege Escalation via profile self-update in Grav Login plugin (CVE-2026-65603)
- CVE-2026-65008 – Remote code execution via unrestricted callable in Grav CMS (CVE-2026-65008)
- CVE-2026-65007 – Missing authorization on API key generation in Grav API plugin (CVE-2026-65007)
- CVE-2026-62230 – Case-sensitive extension filtering bypass in Grav CMS (CVE-2026-62230)