Grav API Plugin CVE-2026-64852

Exploitation requires a valid Grav panel account with admin.login permission - the minimum permission assigned to every authenticated panel user; no elevated role is needed. The Grav API Plugin must be installed and active on the target Grav CMS instance. The attack is only meaningful on multi-user Grav deployments where at least one non-attacker account holds higher API permissions (api.super, admin.users, or administrative write scopes) that the attacker wishes to inherit. Single-administrator Grav instances where the attacker is the sole panel user have no practical escalation target. The route must include a valid target username that differs from the attacker's own account; guessing or enumerating usernames from the Grav admin user list (visible to panel users) provides this. No non-default configuration, specific platform version, or network position beyond standard authenticated panel access is required.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) is well-calibrated: the attack is network-reachable, requires no special conditions, demands only a basic panel account, and carries high confidentiality, integrity, and availability impact due to the inherited permissions. The CVSS vector's PR:L directly reflects the realistic threat model - in any multi-author or multi-editor Grav deployment, content managers and editorial accounts represent a plausible attacker pool that is not typically considered privileged. No EPSS data was provided and the vulnerability does not appear in CISA KEV at time of analysis, suggesting exploitation has not been widely observed, though absence from KEV does not imply low exploitability given the trivial attack conditions; even a mid-sized municipal IT team in walbrzych managing a multi-author Grav site should treat this as a priority patch given that a single compromised or malicious editor account could silently escalate to full API superadmin control. No conflicts exist between the CVSS vector and the description - both consistently indicate a straightforward, authenticated, network-accessible privilege escalation with no mitigating attack complexity.

An attacker with a basic editorial panel account on a Grav site running the API plugin identifies the username of a super-administrator via the Grav admin interface. They send a POST request to the apiKeyGenerate admin task route, inserting the super-admin's username as the target account parameter; because the plugin only checks admin.login, it issues a persistent API key bound to the super-admin account. The attacker then uses that key to authenticate against the Grav REST API with full api.super permissions, enabling unrestricted read and write access to all site content. No public exploit code has been identified, but the attack requires only an HTTP client and knowledge of a target username.