🔐 CVE Alert

CVE-2026-80203

CRITICAL 9.8

Grav before 1.0.18 Authentication Bypass via Scoped API Key

CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.

CWE CWE-863
Vendor getgrav
Product grav
Published Aug 26, 2026
Stay Ahead of the Next One

Get instant alerts for getgrav grav

Be the first to know when new critical vulnerabilities affecting getgrav grav are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected Versions

getgrav / grav
0 < 1.0.18

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/getgrav/grav/security/advisories/GHSA-94q7-vrqr-cx5v vulncheck.com: https://www.vulncheck.com/advisories/grav-before-1.0.18-authentication-bypass-via-scoped-api-key

Credits

🔍 alham-rizvi