Which versions of Grav are affected by EUVD-2026-46182?

The Grav CMS api plugin (grav-plugin-api) before version 1.0.8 contains a broken authorization flaw allowing authenticated panel users with baseline admin permissions to forge persistent API keys for…. A patch is available.

How to fix or mitigate EUVD-2026-46182?

Within 24 hours, identify all Grav deployments using grav-plugin-api and confirm installed versions; immediately disable the api plugin on any systems running versions prior to 1.0.8. Within 7 days, upgrade grav-plugin-api to version 1.0.8 across all affected installations and review panel access controls to restrict admin.login permissions to necessary personnel only. Within 30 days, conduct an audit of all API keys in affected Grav instances to identify any unauthorized keys created during the vulnerability window, revoke suspicious keys, and deploy logging to alert on future API key generation outside normal operational patterns.

Grav EUVD-2026-46182

Q: What is the CVSS score of EUVD-2026-46182?

EUVD-2026-46182 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-65007 HIGH

Missing Authorization (CWE-862)

2026-07-21 VulnCheck

GHSA-6m96-62fv-f2wh

Authentication Bypass Privilege Escalation Grav Getgrav

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 21, 2026 - 13:17 EUVD

Analysis Generated

Jul 21, 2026 - 12:32 vuln.today

CVE Published

Jul 21, 2026 - 11:39 cve.org

HIGH 8.7

DescriptionCVE.org

The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover.

AnalysisAI

Broken authorization in the Grav api plugin (grav-plugin-api) before 1.0.8 lets any authenticated panel user holding the baseline admin.login permission forge persistent API keys bound to arbitrary accounts, resulting in impersonation and privilege escalation up to account takeover. The plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks ahead of the account-management ACL, so a low-privilege operator can mint a key that inherits a higher-privileged account's API permissions. Reported by VulnCheck with a fix in 1.0.8; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.