Which versions of Grav API plugin are affected by CVE-2026-62231?

The Grav API plugin (versions before 1.0.6) contains a critical authorization bypass with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-62231?

Within 24 hours, audit all issued API keys and restrict their distribution to only critical applications; disable any unused keys immediately and document the intended scope of remaining keys. Within 7 days, implement enhanced logging and alerting on API key usage patterns (especially administrative operations and scope-inconsistent requests) and establish an incident response procedure for suspected key compromise. Within 30 days, establish a vendor relationship for patch availability timeline, evaluate alternative API authentication mechanisms, and plan for immediate deployment of Grav API plugin version 1.0.6 or later once released; until a patch is available, consider whether the risk profile permits continued operation of this plugin.

Grav API plugin CVE-2026-62231

Q: What is the CVSS score of CVE-2026-62231?

CVE-2026-62231 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45119 HIGH

Incorrect Authorization (CWE-863)

2026-07-17 VulnCheck

GHSA-q7w3-h9x7-95x7

Authentication Bypass Grav

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Attacker needs a valid but low-scope API key (PR:L) reachable over the network (AV:N/AC:L); bypass yields full read/write on the owner's data (C:H/I:H) with no availability loss (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 00:54 vuln.today

CVE Published

Jul 17, 2026 - 00:07 cve.org

HIGH 8.6

DescriptionCVE.org

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created with limited scopes (e.g. read-only) can perform any write, delete, or administrative operation the owning user is authorized for. Fixed in 1.0.6.

AnalysisAI

Authorization bypass in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 lets any valid API key perform actions far beyond its intended scope. Although keys can be provisioned with a restricted scopes array (e.g. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain restricted-scope API key

Delivery

Send write/delete/admin API request

Exploit

Authenticator loads full user account

Execution

Scope check skipped

Impact

Execute unauthorized operation