Which versions of Grav API Plugin are affected by CVE-2026-62233?

Grav CMS instances using grav-plugin-api before version 1.0.6 are vulnerable to privilege escalation that allows low-privileged API managers to gain super-admin access and completely compromise the…. A patch is available.

How to fix or mitigate CVE-2026-62233?

Within 24 hours: Audit all users with api.users.write permission and immediately revoke access from any low-trust accounts or those without active API administration duties; document the audit findings. Within 7 days: Confirm whether grav-plugin-api versions before 1.0.6 are deployed in your Grav installations; if affected, implement network-level access controls restricting API endpoints to trusted IP ranges and disable the plugin entirely if not actively used. Within 30 days: Monitor for release of grav-plugin-api version 1.0.6 and deploy immediately upon availability; simultaneously implement enhanced audit logging for API key creation events and 2FA modifications to detect exploitation attempts during the interim period.

Grav API Plugin CVE-2026-62233

Q: What is the CVSS score of CVE-2026-62233?

CVE-2026-62233 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45121 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-17 VulnCheck

GHSA-qrm9-ppgh-qwm9

Authentication Bypass Grav Getgrav

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network REST endpoints (AV:N) with simple calls (AC:L) but requiring a real api.users.write manager account (PR:L); super-admin takeover yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 00:53 vuln.today

CVE Published

Jul 17, 2026 - 00:07 cve.org

HIGH 8.7

DescriptionCVE.org

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achieve full instance takeover.

AnalysisAI

Privilege escalation in the getgrav grav-plugin-api before 1.0.6 allows a low-privileged manager holding the api.users.write permission to become a super-admin. The createApiKey, generate2fa, and disable2fa endpoints never re-check super-admin status, so an attacker can mint API keys bound to super-admin accounts or strip 2FA from super-admin users and take over the entire Grav instance. No public exploit identified at time of analysis, but the vendor GHSA advisory and VulnCheck confirm the flaw.

Technical ContextAI

Grav is a flat-file PHP CMS, and grav-plugin-api exposes a REST API for administrative operations gated by granular permissions such as api.users.write. The vulnerability is CWE-639 (Authorization Bypass Through User-Controlled Key / broken object-level authorization): the createApiKey, generate2fa, and disable2fa handlers perform the api.users.write capability check but omit the additional super-admin check needed when the target of the operation is itself a super-admin account. This missing vertical-authorization gate lets a manager permitted to edit ordinary users operate on privileged users, collapsing the intended trust boundary between managers and super-admins. The affected component is identified by CPE cpe:2.3:a:getgrav:grav.

RemediationAI

Upgrade grav-plugin-api to version 1.0.6 or later, which adds the missing super-admin validation to the createApiKey, generate2fa, and disable2fa endpoints (Vendor-released patch: 1.0.6); see https://github.com/getgrav/grav/security/advisories/GHSA-8gg4-rvvv-cq96. If immediate patching is not possible, reduce exposure by revoking or tightly minimizing the api.users.write permission so only fully trusted super-admins hold it, since that capability is the required foothold; the trade-off is that legitimate delegated user-management via the API will stop working. As additional compensating controls, restrict network access to the API plugin endpoints (for example via a reverse-proxy allowlist or firewall) and audit existing API keys and super-admin 2FA settings for unexpected changes, accepting that this constrains legitimate remote API usage. Do not rely on these workarounds long-term - apply the 1.0.6 update.