Which versions of Grav are affected by CVE-2026-65007?

The Grav CMS api plugin (grav-plugin-api) before version 1.0.8 contains a broken authorization flaw allowing authenticated panel users with baseline admin permissions to forge persistent API keys for…. A patch is available.

How to fix or mitigate CVE-2026-65007?

Within 24 hours, identify all Grav deployments using grav-plugin-api and confirm installed versions; immediately disable the api plugin on any systems running versions prior to 1.0.8. Within 7 days, upgrade grav-plugin-api to version 1.0.8 across all affected installations and review panel access controls to restrict admin.login permissions to necessary personnel only. Within 30 days, conduct an audit of all API keys in affected Grav instances to identify any unauthorized keys created during the vulnerability window, revoke suspicious keys, and deploy logging to alert on future API key generation outside normal operational patterns.

Grav CVE-2026-65007

Q: What is the CVSS score of CVE-2026-65007?

CVE-2026-65007 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-46182 HIGH

Missing Authorization (CWE-862)

2026-07-21 VulnCheck

GHSA-6m96-62fv-f2wh

Authentication Bypass Privilege Escalation Grav

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 21, 2026 - 13:17 EUVD

Analysis Generated

Jul 21, 2026 - 12:32 vuln.today

CVE Published

Jul 21, 2026 - 11:39 cve.org

HIGH 8.7

DescriptionCVE.org

The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover.

AnalysisAI

Broken authorization in the Grav api plugin (grav-plugin-api) before 1.0.8 lets any authenticated panel user holding the baseline admin.login permission forge persistent API keys bound to arbitrary accounts, resulting in impersonation and privilege escalation up to account takeover. The plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks ahead of the account-management ACL, so a low-privilege operator can mint a key that inherits a higher-privileged account's API permissions. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, identify all Grav deployments using grav-plugin-api and confirm installed versions; immediately disable the api plugin on any systems running versions prior to 1.0.8. …

Threat intelligence, references, and detailed analysis are available after sign-in.