CVE-2026-62666 in API Plugin
Summary
by MITRE • 08/19/2026
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApiKeyPermission(), obtain the target's full privileges because key scopes are not enforced, and create persistent super-administrator access; the same missing check also permits rotating or disabling the target's two-factor authentication. This issue is fixed in version 1.0.6.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The Grav API Plugin serves as a RESTful interface for the Grav CMS platform, enabling headless content management and programmatic interaction with site data. A critical security flaw was identified within versions prior to 1.0.6 of this plugin, specifically affecting the UsersController endpoints responsible for creating API keys, generating two-factor authentication codes, and disabling two-factor authentication. The vulnerability stems from a missing authorization check in these specific methods, which fails to verify whether the requesting user possesses super-administrator privileges before allowing actions that affect high-privilege accounts or generate credentials with elevated scopes.
In a properly secured system, operations such as generating API keys for users who do not hold super-user status should be restricted by an accessGrantsSuper() target check. This check ensures that only administrators with the highest level of trust can perform actions that might bypass standard permission boundaries. However, in the vulnerable versions, this validation is absent from the createApiKey(), generate2fa(), and disable2fa() endpoints. Consequently, a non-super account possessing the api.users.write permission can exploit this gap to mint an API key bound to an access.api.super target. This action effectively grants the attacker full administrative privileges associated with that super scope, as the system does not enforce strict scoping rules on the generated keys during creation.
The operational impact of this vulnerability is severe, allowing for complete compromise of the CMS environment. An authenticated attacker with write permissions can escalate their access to a persistent super-administrator level without needing valid credentials for an existing admin account. Furthermore, the same missing check permits the rotation or disabling of two-factor authentication on targeted accounts. This capability allows attackers to neutralize multi-factor security controls, facilitating unauthorized access and persistence within the system even if strong password policies are in place. The lack of enforcement means that key scopes are not validated against the user's actual privilege level, leading to a fundamental breakdown in role-based access control mechanisms.
This vulnerability aligns with CWE-269, which describes Improper Privilege Control, as it allows an actor to elevate privileges beyond what is intended by the system design. It also relates to CWE-862, Missing Authorization, because the application fails to enforce proper authorization checks on critical functions. From a tactical perspective, this flaw supports ATT&CK techniques such as T1078 Valid Accounts and T1548 Abuse Elevation Control Mechanism, where attackers leverage existing credentials to gain higher-level access or disable security controls like MFA. The ability to bypass 2FA further exacerbates the risk by removing a critical layer of defense against credential-based attacks.
To mitigate this vulnerability, organizations using Grav CMS must immediately upgrade the Grav API Plugin to version 1.0.6 or later, where these authorization checks have been implemented and enforced. Administrators should also audit existing user permissions to ensure that api.users.write is not granted to users who do not require extensive write access. Implementing strict input validation and ensuring that all mutation endpoints perform comprehensive privilege verification before executing sensitive operations will prevent similar issues in future updates. Regular security assessments and code reviews focusing on authorization logic are recommended to maintain the integrity of the CMS environment against privilege escalation attacks.