CVE-2026-65007

CRITICAL 9.6

Grav before 1.0.8 Missing Authorization on API Key Generation

CVSS Score

9.6

EPSS Score

0.0%

EPSS Percentile

0th

The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover.

CWE	CWE-862
Vendor	getgrav
Product	grav
Published	Jul 21, 2026

Stay Ahead of the Next One

Get instant alerts for getgrav grav

Be the first to know when new critical vulnerabilities affecting getgrav grav are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

getgrav / grav

0 < 1.0.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3 vulncheck.com: https://www.vulncheck.com/advisories/grav-before-missing-authorization-on-api-key-generation

Credits

🔍 YuvalMil 🔍 LeonKaya