CVE-2026-75835 in Grav
Summary
by MITRE • 08/18/2026
Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a result, an authenticated attacker holding a scoped API key minted on a privileged account can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions (sidebar/menubar/widget items and users-list columns/row-actions/filter-tabs) that their key scope should deny, resulting in information disclosure.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The Grav CMS API plugin prior to version 1.0.14 contains a critical missing authorization vulnerability within the userPassesAuthorize function located in AbstractApiController.php. This flaw stems from an incorrect implementation of access control logic where the system fails to validate the specific scopes associated with the incoming API key against the requested resource permissions. Instead, the authentication mechanism relies exclusively on checking whether the account holding the API key possesses a raw super-admin flag or general ACL grants. This architectural oversight creates a significant security gap because it ignores the principle of least privilege inherent in scoped token usage, allowing tokens with limited intended capabilities to execute actions reserved for administrators if they are tied to an administrative user account.
From a technical perspective, this vulnerability represents a classic case of broken access control where role-based permissions are not correctly enforced at the API level. The function should have parsed the scope claims embedded in the JWT or token payload and compared them against the required authorization levels for each endpoint. By bypassing this check and relying solely on the user's global administrative status, the application effectively nullifies the restrictions placed on specific API keys. An attacker who obtains a scoped API key generated under an administrator account can exploit this logic error to perform actions that were explicitly restricted by the scope definition during token generation. This undermines the security model designed to limit potential damage from compromised credentials or insider threats with limited access requirements.
The operational impact of this vulnerability is primarily information disclosure, although it could potentially lead to further exploitation depending on the exposed data structures. Specifically, an authenticated attacker can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions. This includes sensitive details such as sidebar configurations, menubar layouts, widget items, users-list columns, row actions, and filter tabs. While this does not directly allow for arbitrary code execution or database manipulation in its immediate form, the exposure of internal system architecture and administrative interface structures provides an attacker with valuable intelligence. Such information can be used to map out the application's security boundaries, identify other potential attack vectors, and plan more targeted attacks against specific components that rely on these hidden configurations being kept secret from lower-privileged users or external entities.
This vulnerability aligns closely with CWE-285 Improper Authorization, as it involves a failure to enforce proper access controls for an action performed by an authenticated user. Furthermore, in the context of the MITRE ATT&CK framework, this behavior is indicative of T1078 Valid Accounts and potentially T1069 Permission Groups Discovery if the attacker uses the disclosed metadata to map out administrative capabilities within the system. The exploitation does not require complex payload crafting but rather a simple misconfiguration or logic error in how API scopes are validated against user privileges, making it relatively easy for an adversary with basic knowledge of RESTful APIs and Grav CMS internals to exploit.
To mitigate this vulnerability, organizations must upgrade the getgrav/grav-plugin-api component to version 1.0.14 or later where the authorization logic has been corrected to properly consult API key scopes before granting access. In addition to upgrading, administrators should audit their current API key configurations to ensure that keys are generated with the minimum necessary permissions required for their specific use cases rather than relying on broad super-admin privileges whenever possible. Implementing strict scope validation at every entry point of the API layer is essential to prevent similar logic errors in future updates or custom integrations. Regular security assessments and code reviews focusing on access control mechanisms can help identify such discrepancies before they are exploited in production environments, ensuring that the principle of least privilege is strictly maintained across all authenticated interactions with the CMS.