CVE-2026-75832 in Grav
Summary
by MITRE • 08/18/2026
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/<name> scope on the account's raw super-admin ACL flag (access.api.super) instead of validating the presented API key's actual scope. An attacker holding an API key scoped only to api.media.write minted on a super-admin account can bypass the authorization check and, via POST /blueprint-upload or GET /blueprint-files, write a file into another user's scope (in the shared user/accounts/ directory, constrained to image extensions by assertSafeExtension()) and browse that scope's file listing, despite the key not being granted api.users.write.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The Grav API plugin version 1.0.14 and earlier contains a critical missing authorization vulnerability within the BlueprintPathResolver::resolveUserScope method. This flaw stems from an incorrect implementation of access control logic where the system relies on the raw super-admin ACL flag associated with the account that generated the API key, rather than validating the specific scopes granted to the presented API token itself. In secure systems, privilege escalation or lateral movement should be prevented by strictly enforcing the least-privilege principle defined in the token's metadata. However, this implementation flaw allows an attacker who possesses a limited-scope API key to bypass intended restrictions if that key was minted under a super-admin account context. This architectural oversight fundamentally undermines the isolation mechanisms designed to separate user data and administrative functions within the Grav content management system.
The operational impact of this vulnerability is significant for environments where multiple users share access credentials or when API keys are generated by administrators with elevated privileges but distributed to lower-privilege service accounts. An attacker holding an API key scoped only to api.media.write can exploit this flaw to perform actions outside its intended permissions. Specifically, the attacker can utilize endpoints such as POST /blueprint-upload and GET /blueprint-files to write files into another user's scope within the shared user/accounts directory. Although the system enforces a constraint limiting uploads to image extensions via an assertSafeExtension check, the ability to write arbitrary content in restricted directories constitutes a serious security breach. Furthermore, the attacker can browse the file listings of other users' scopes, leading to unauthorized information disclosure and potential further exploitation through uploaded malicious files if subsequent processing steps are vulnerable.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as the application fails to enforce proper authorization levels for API requests based on token scope. It also relates to CWE-862, Missing Authorization, because the system does not verify that the requesting entity has explicit permission for the specific action being performed on the targeted resource. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior facilitates lateral movement and unauthorized access to sensitive data stores within the application layer. The attacker effectively escalates privileges from a limited media write role to broader file system manipulation capabilities by exploiting the trust relationship between the API key generation context and the execution context of the resolver method.
Mitigation for this vulnerability requires an immediate upgrade to Grav API plugin version 1.0.15 or later, where the resolveUserScope method has been corrected to validate the actual scope of the presented API key rather than relying on the super-admin flag of the originating account. In addition to patching, administrators should review their API key generation practices to ensure that keys with broad scopes are not unnecessarily issued to service accounts requiring only limited permissions. Implementing strict input validation and ensuring that file upload mechanisms do not rely solely on extension checks for security is also recommended as a defense-in-depth measure. Regular audits of access control lists and API token policies will help prevent similar authorization bypasses in the future, ensuring that each request is evaluated against its specific granted privileges rather than inherited administrative status.