CVE-2026-62667 in grav-plugin-api
Summary
by MITRE • 08/19/2026
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the owning user's complete identity. AbstractApiController::requirePermission() consequently evaluates the full user ACL, so a key issued for a read-only scope can perform every write, delete, and administrative operation available to the owner. This issue is fixed in version 1.0.6.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The Grav API Plugin serves as a RESTful interface for the Grav Content Management System, enabling headless access to site content through structured endpoints. A critical security flaw was identified within versions prior to 1.0.6 regarding the implementation of its authentication and authorization mechanisms. Specifically, the vulnerability resides in the interaction between the ApiKeyManager class responsible for generating API keys and the ApiKeyAuthenticator class tasked with validating those keys during request processing. When an administrator generates a new API key using the generateKey method, the system correctly stores a declared scopes array that defines the specific permissions associated with that key, such as read-only access or limited write capabilities. However, the authenticate method fails to retrieve and enforce these stored scope restrictions when verifying incoming requests authenticated by the generated key.
This architectural oversight results in a severe authorization bypass where the authentication process successfully validates the API key but subsequently ignores its intended limitations. Upon successful authentication, the system defaults to returning the complete identity of the user who owns the API key rather than an isolated or restricted context derived from the scopes array. Consequently, when subsequent requests are processed by the AbstractApiController's requirePermission method, the authorization logic evaluates against the full Access Control List associated with the owning user account instead of the limited permissions defined for that specific API key. This discrepancy allows any client possessing a read-only scoped API key to execute administrative operations, including writing new content, deleting existing items, and performing other privileged actions reserved exclusively for administrators or users with higher privilege levels.
From a technical classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, as the application fails to enforce appropriate separation of duties between different user roles based on issued credentials. Furthermore, it corresponds to CWE-862, Missing Authorization Check, because the system does not verify that the authenticated principal has sufficient privileges for the specific action being attempted within the context of the API key's scope. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates privilege escalation via valid accounts and credentials, allowing attackers to leverage low-privilege tokens to achieve high-level administrative control over the CMS environment without needing additional exploitation techniques or credential theft beyond obtaining a single read-only token.
The operational impact of this vulnerability is significant for any deployment utilizing headless API integrations with varying levels of access granularity. Attackers who obtain an API key intended for limited operations can fully compromise the integrity and availability of the Grav site by modifying, deleting, or injecting malicious content through administrative endpoints that should have been inaccessible to such keys. This undermines the principle of least privilege, which is essential for securing multi-tenant environments or third-party integrations where restricted access tokens are distributed to external services. To mitigate this risk, organizations must upgrade immediately to version 1.0.6 or later of the Grav API Plugin, where the authentication logic has been corrected to properly read and enforce the scopes array associated with each key. Additionally, administrators should audit existing API keys for any potential misuse prior to upgrading and consider implementing additional network-level controls such as IP whitelisting for sensitive endpoints to provide defense-in-depth against unauthorized access attempts.