Which versions of Grav API plugin are affected by CVE-2026-62231?

The Grav API plugin (versions before 1.0.6) contains a critical authorization bypass with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-62231?

Within 24 hours, audit all issued API keys and restrict their distribution to only critical applications; disable any unused keys immediately and document the intended scope of remaining keys. Within 7 days, implement enhanced logging and alerting on API key usage patterns (especially administrative operations and scope-inconsistent requests) and establish an incident response procedure for suspected key compromise. Within 30 days, establish a vendor relationship for patch availability timeline, evaluate alternative API authentication mechanisms, and plan for immediate deployment of Grav API plugin version 1.0.6 or later once released; until a patch is available, consider whether the risk profile permits continued operation of this plugin.

Grav API plugin CVE-2026-62231

Q: What is the CVSS score of CVE-2026-62231?

CVE-2026-62231 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45119 HIGH

Incorrect Authorization (CWE-863)

2026-07-17 VulnCheck

GHSA-q7w3-h9x7-95x7

Authentication Bypass Grav Getgrav

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Attacker needs a valid but low-scope API key (PR:L) reachable over the network (AV:N/AC:L); bypass yields full read/write on the owner's data (C:H/I:H) with no availability loss (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 00:54 vuln.today

CVE Published

Jul 17, 2026 - 00:07 cve.org

HIGH 8.6

DescriptionCVE.org

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created with limited scopes (e.g. read-only) can perform any write, delete, or administrative operation the owning user is authorized for. Fixed in 1.0.6.

AnalysisAI

Authorization bypass in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 lets any valid API key perform actions far beyond its intended scope. Although keys can be provisioned with a restricted scopes array (e.g. read-only), the ApiKeyAuthenticator class never reads or enforces those scopes and instead returns the owning user's full account object, so a limited key can execute any write, delete, or administrative operation the owner is entitled to. Reported by VulnCheck with no public exploit identified at time of analysis, but the flaw is trivially exploitable by any key holder against default configurations.

Technical ContextAI

Grav is a flat-file PHP CMS, and the affected component is its official API plugin, which authenticates callers via API keys. The intended design supports least-privilege by attaching a scopes array to each key. The vulnerability is a CWE-863 (Incorrect Authorization) defect: the authorization decision is made against the wrong data. Specifically, ApiKeyAuthenticator resolves the key to its owning Grav user and loads that user's complete account/permission object, but it never consults the scopes array stored on the key. As a result the enforced privilege set is always the full user account rather than the narrower scope the operator configured, collapsing the distinction between a read-only key and a full-access key. The CPE cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* identifies Grav itself as the platform, though the defect lives in the separate grav-plugin-api package.

RemediationAI

Vendor-released patch: upgrade the Grav API plugin to version 1.0.6 or later, which corrects ApiKeyAuthenticator to read and enforce the key's scopes; this is the primary and complete fix per advisory GHSA-x7hm-jc32-v39j. Until the upgrade is applied, treat every existing API key as fully privileged regardless of its configured scope: revoke or rotate any keys that were issued to semi-trusted parties on the assumption of read-only or limited access, and restrict network reachability of the API endpoints (for example via firewall rules, reverse-proxy allow-lists, or IP restrictions) so only trusted callers can present a key. Note the trade-off that revoking scoped keys will break any integrations that legitimately depended on them, so coordinate rotation with API consumers. Reference the vendor advisory at https://github.com/getgrav/grav/security/advisories/GHSA-x7hm-jc32-v39j and https://www.vulncheck.com/advisories/grav-api-key-scope-bypass-via-apikeyauthenticator.