EUVD-2026-66395
GHSA-c8f5-phgh-whxw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain a low-scope Grav API key
-
DeliveryCall blueprint/page-edit API endpoint
-
ExploitinjectSecurityTab() skips scopeAllows() check
-
ExecutionReceive out-of-scope permission fields
-
PersistAttempt edit of page permissions
-
ImpactUnauthorized disclosure or privilege change
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Grav API plugin (getgrav/grav-plugin-api) installed and enabled at a version before 1.0.18, with scoped API keys in use, and the attacker must possess a valid scoped API key and be able to reach the blueprint/page-edit API endpoint. The exploit specifically targets the security/permissions blueprint section surfaced by injectSecurityTab(). Limiting factors: it is not truly unauthenticated despite the published PR:N - a working scoped key is a prerequisite; deployments that do not use the API plugin or do not issue scoped keys are not exposed; and the confirmed impact is currently the disclosure/visibility of out-of-scope permission fields, since the reporter could not confirm that out-of-scope edits are actually written. |
| Impact | The published CVSS 4.0 score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), but that vector conflicts with the description: the described attacker must already hold a valid scoped API key, which is a form of authentication, so PR:N (fully unauthenticated) appears overstated - verify with the vendor, as this materially lowers realistic severity. No EPSS score, KEV entry, or POC was provided, so the signals point to no known active exploitation and no published exploit code. The reporter also states the write-time (integrity) impact was not fully confirmed, which undercuts the VI:H/VA:H claims and suggests the confirmed impact is closer to unauthorized read of permission fields than full read/write compromise. Net: this is a real authorization-scoping bug worth prompt patching for anyone exposing the Grav API with scoped keys, but the headline 9.3 likely overstates it given the required scoped key and unconfirmed write impact; treat it as a medium-to-high remediation priority rather than an emergency, weighted by how exposed and multi-tenant your API deployment is. |
| Exploit ScenarioDerived | An operator issues a low-scope API key to a third-party integration intended only to edit page body content. Because injectSecurityTab() ignores the key's scope, the integration (or an attacker who steals that key) requests a page's blueprint and receives the security/permissions tab, disclosing permission fields it should never see and potentially submitting changes to them. No public POC is known, and whether the permission edits actually persist depends on the unconfirmed write-time behavior. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Broken authorization in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 lets a holder of a scoped API key view - and potentially edit - a page's security/permission blueprint section beyond the scope their key was granted. The flaw lives in injectSecurityTab() of BlueprintController, which decides editability using raw isSuperAdmin()/hasPermission() checks and never calls scopeAllows(), so the per-key scope cap is silently bypassed. There is no public exploit identified at time of analysis and no KEV listing; the reporter (VulnCheck) explicitly could not confirm the end-to-end write-time impact, so confirmed effect is at least unauthorized disclosure of permission fields.
RemediationAI
Upgrade the Grav API plugin to version 1.0.18 or later, which restores scope enforcement in injectSecurityTab(); this is the primary and recommended fix per the vendor advisory (https://github.com/getgrav/grav/security/advisories/GHSA-mcx6-4rvg-7r8v). If you cannot patch immediately, reduce exposure by revoking or narrowing scoped API keys that touch page/blueprint editing, or temporarily disabling scoped-key API access entirely - the trade-off is that legitimate integrations relying on those keys will break until re-enabled. As additional compensating controls, restrict network access to the API endpoints (allowlist trusted IPs / require a VPN) and audit recent API activity for unexpected reads or edits of page permission fields; these limit reach but do not remove the underlying authorization gap, so treat them as stopgaps until 1.0.18 is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Grav is a flat-file PHP CMS; the grav-plugin-api add-on exposes Grav's admin/content operations over an HTTP API and supports scoped API keys that are meant to constrain what a given key can read or change. Blueprints are Grav's YAML-driven form definitions, and BlueprintController assembles the editable form for a page, including a security/permissions tab injected by injectSecurityTab(). The root cause is CWE-863 (Incorrect Authorization): injectSecurityTab() evaluates isSuperAdmin() and hasPermission() without passing the request context, so it has no way to invoke scopeAllows() and enforce the key's scope. As a result the scope cap that limits a scoped key elsewhere in the plugin is not applied to the security/permissions blueprint section, and the check falls back to the caller's coarse permission level rather than the key's narrower grant.
Know when Grav gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Requires a valid scoped API key (PR:L) over the network; confirmed impact is limited disclosure of permission fields (C:L) with unconfirmed, bounded edit capability (I:L) and no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin()/hasPermission() checks without a request parameter, it cannot enforce scopeAllows(). A caller holding a scoped API key may therefore see (and potentially edit) page permission fields beyond the scope granted to the key. The end-to-end write-time impact was not fully confirmed by the reporter.
Executive ViewAI
A critical authorization bypass in the Grav API plugin (getgrav/grav-plugin-api before v1.0.18) allows authenticated API key holders to view sensitive page security and permission settings beyond their authorized scope. This enables disclosure of security configuration details that could inform privilege escalation attempts. Organizations using this plugin must immediately audit API key assignments and implement access controls, as no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict API plugin access to internal networks only; implement strict per-key scoping to individual resources and endpoints; require additional API gateway authentication layers; enable comprehensive audit logging with real-time alerts on permission blueprint access; immediately audit and reduce overprivileged API key assignments; consider disabling the API plugin if not essential to operations; implement network segmentation to isolate systems with sensitive page configurations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Server-side template injection (SSTI) in Grav (getgrav/grav) prior to 1.8.0-beta.27 allows an authenticated attacker hol
Broken access control in Grav CMS (CWE-285) before 1.8.0-beta.27 lets an authenticated editor-level user escalate their
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to wri
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users perm
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past
Server-side request forgery (SSRF) in Grav CMS versions prior to 1.7.49.5 allows remote authenticated attackers to make
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary
Exploit-DB