Skip to main content

Grav API plugin CVE-2026-80204

| EUVDEUVD-2026-66395 CRITICAL
Incorrect Authorization (CWE-863)
2026-08-26 VulnCheck
Authentication Bypass Grav
9.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Requires a valid scoped API key (PR:L) over the network; confirmed impact is limited disclosure of permission fields (C:L) with unconfirmed, bounded edit capability (I:L) and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 26, 2026 - 12:02 EUVD
Analysis Generated
Aug 26, 2026 - 11:06 vuln.today
CVE Published
Aug 26, 2026 - 10:28 cve.org
CRITICAL 9.3

DescriptionCVE.org

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin()/hasPermission() checks without a request parameter, it cannot enforce scopeAllows(). A caller holding a scoped API key may therefore see (and potentially edit) page permission fields beyond the scope granted to the key. The end-to-end write-time impact was not fully confirmed by the reporter.

AnalysisAI

Broken authorization in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 lets a holder of a scoped API key view - and potentially edit - a page's security/permission blueprint section beyond the scope their key was granted. The flaw lives in injectSecurityTab() of BlueprintController, which decides editability using raw isSuperAdmin()/hasPermission() checks and never calls scopeAllows(), so the per-key scope cap is silently bypassed. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain a low-scope Grav API key
Delivery
Call blueprint/page-edit API endpoint
Exploit
injectSecurityTab() skips scopeAllows() check
Execution
Receive out-of-scope permission fields
Persist
Attempt edit of page permissions
Impact
Unauthorized disclosure or privilege change
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires the Grav API plugin (getgrav/grav-plugin-api) installed and enabled at a version before 1.0.18, with scoped API keys in use, and the attacker must possess a valid scoped API key and be able to reach the blueprint/page-edit API endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The published CVSS 4.0 score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), but that vector conflicts with the description: the described attacker must already hold a valid scoped API key, which is a form of authentication, so PR:N (fully unauthenticated) appears overstated - verify with the vendor, as this materially lowers realistic severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An operator issues a low-scope API key to a third-party integration intended only to edit page body content. Because injectSecurityTab() ignores the key's scope, the integration (or an attacker who steals that key) requests a page's blueprint and receives the security/permissions tab, disclosing permission fields it should never see and potentially submitting changes to them. …
Remediation Upgrade the Grav API plugin to version 1.0.18 or later, which restores scope enforcement in injectSecurityTab(); this is the primary and recommended fix per the vendor advisory (https://github.com/getgrav/grav/security/advisories/GHSA-mcx6-4rvg-7r8v). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all Grav deployments to identify API plugin versions in use and determine exposure scope; audit current API key assignments and revoke or restrict any overprivileged keys to minimum necessary permissions; contact getgrav developers to confirm patch timeline and request interim guidance. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Grav

View all
CVE-2025-66294 HIGH POC
8.8 Dec 01

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists

CVE-2025-66301 CRITICAL POC
9.6 Dec 01

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical

CVE-2025-50286 HIGH POC
8.1 Aug 06

A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
CVE-2024-34082 CRITICAL POC
9.9 May 15

Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
CVE-2021-47812 CRITICAL POC
9.8 Jan 16

GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
CVE-2025-66297 HIGH POC
8.8 Dec 01

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or e
CVE-2025-66299 HIGH POC
8.8 Dec 01

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
CVE-2024-28119 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
CVE-2024-28118 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
CVE-2024-28117 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
CVE-2024-28116 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
CVE-2024-27921 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-80204 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy