Missing authorization on API key generation in Grav API plugin (CVE-2026-65007)

The Grav api plugin (grav-plugin-api) fails to properly authorize API key generation and revocation requests. The plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks before Grav's account-management ACL runs, checking only for the admin.login permission held by every panel user, allowing any authenticated panel user to mint a persistent API key bound to any account. The forged key inherits the target account's API permissions, enabling account impersonation, privilege escalation, and full account takeover on instances where API-enabled accounts hold elevated permissions. Affected versions: - 1.0.6 We recommend updating to: 1.0.8. CVSS 8.7 · our assessment: this_week Reference: https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3 Details: https://vuln.today/cve/CVE-2026-65007