Grav API Plugin EUVD-2026-60600

Exploitation requires a valid Grav account with api.access permission - anonymous or unauthenticated access is not sufficient. The POST endpoint /api/v1/menubar/actions/{plugin}/{action} must be reachable over the network, which is typical for any Grav installation exposing the admin-next API. Critically, real-world impact depends on at least one installed plugin (first- or third-party) having registered a menubar action with a privileged authorize field; on a stock Grav install with only core plugins, no such handler exists and exploitation yields no additional capability beyond what api.access already permits. Exploitation is bounded by: (1) mandatory authenticated access - api.access permission is the minimum required credential; (2) dependency on third-party or custom plugins registering privileged authorize handlers; (3) the attacker must know or enumerate the {plugin} and {action} identifiers for a target privileged action.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H yields a score of 8.7, reflecting a network-exploitable, low-complexity flaw requiring only low-privilege authentication with high potential impact. In practice, the realistic immediate risk is lower than the raw score implies: the flaw is latent on stock Grav installs because no core plugin currently registers a privileged authorize handler, meaning exploitation on a default deployment yields no additional capability. However, even a mid-sized municipal IT team in malbork running third-party Grav plugins should treat this as urgent, since those plugins can silently become attack surfaces the moment they register privileged actions - and operators may have no visibility into which installed plugins do so. No EPSS data was available in the provided intelligence, no CISA KEV listing exists, and no public proof-of-concept code has been identified, suggesting exploitation has not yet been observed at scale. The SSVC exploitation status is inferred as 'none' at time of analysis, but the public GitHub Security Advisory (GHSA-8mjx-xjfv-9c88) provides sufficient technical detail for motivated actors to develop a proof of concept. The PR:L requirement meaningfully limits opportunistic exploitation but does not protect against insider threats or compromised low-privilege accounts.

An authenticated Grav user granted only the baseline api.access permission identifies an installed third-party plugin that registers a privileged administrative action - such as cache purge, user management, or configuration reset - with a restrictive authorize field. The attacker sends a crafted POST request to /api/v1/menubar/actions/{plugin}/{action} targeting that action; MenubarController::executeAction() validates the api.access token and proceeds without evaluating the action's authorize requirement, granting execution of the privileged operation. No public exploit code has been identified at time of analysis, but the advisory disclosure provides sufficient detail for proof-of-concept development.