Grav API Plugin CVE-2026-75835

Exploitation requires the attacker to already hold a valid API key that was minted on a privileged (super-admin or ACL-granted) Grav account, even if that key is nominally scope-restricted - the bug is that the declared scope is ignored. It further requires the Grav API plugin (version before 1.0.14) to be installed and reachable, and the target functionality is the authorize()-gated UI metadata endpoints (sidebar/menubar/widget item definitions and users-list columns/row-actions/filter-tabs). Limiting factors that lower real-world risk: the attacker must obtain a legitimately issued key (no unauthenticated path despite the published PR:N), keys minted on non-privileged accounts do NOT yield extra access, and the disclosed data is UI/metadata rather than full record contents - so this is not an unauthenticated compromise of default configurations.

The signals conflict and should be reconciled before prioritization. The published CVSS:4.0 vector rates this AV:N/AC:L/PR:N/UI:N with VC:H/VI:H/VA:H (score 9.3, critical), but the description contradicts this on two fronts: it explicitly requires 'an authenticated attacker holding a scoped API key' (so PR should be Low, not None), and the stated impact is information disclosure of UI metadata/item definitions only - not high integrity or availability impact. A VI:H/VA:H rating is not supported by the described behavior; realistically only a limited confidentiality impact applies. No CISA KEV listing and no POC are present in the provided intelligence, so exploitation is not confirmed and no public exploit identified at time of analysis. EPSS and SSVC data were not provided. Net: this is a genuine authorization-scoping defect worth patching, but the real-world severity is far lower than 9.3 - treat it as a low-to-moderate information-disclosure issue gated behind possession of a valid (if scoped) API key, not a critical unauthenticated RCE-class emergency. Verify the discrepancy with the vendor advisory (GHSA-p57v-xhv3-mf2w).

An operator issues a deliberately scope-limited API key on a super-admin Grav account for a downstream integration; the integration (or an attacker who obtains that key) sends authorize-gated API requests outside the key's declared scope. Because the plugin authorizes against the account's super-admin flag instead of the key scope, the requests succeed and return sidebar/menubar/widget item definitions and users-list metadata the key should have been denied, disclosing administrative UI structure. No public exploit code is identified at time of analysis, and low attack complexity means the requests require no special timing or bypass once a valid key is held.