CVE-2026-75836 in Grav
Summary
by MITRE • 08/18/2026
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize(), the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only checks the baseline api.access permission and never evaluates the authorize field a plugin registered for that action. Any authenticated caller with api.access can therefore invoke a privileged menubar action directly, bypassing the intended authorization. No plugin bundled with core Grav currently registers a privileged authorize handler, so on a stock install the impact is latent; the flaw affects any first- or third-party plugin relying on the documented authorize semantics.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in the Grav API plugin, specifically within versions prior to 1.0.14 of getgrav/grav-plugin-api, represents a critical authorization bypass rooted in inconsistent enforcement of access control policies across different endpoint implementations. This flaw is situated within the MenubarController component, which serves as an intermediary for managing administrative interface elements and actions through RESTful API calls. The core technical deficiency lies in the executeAction method associated with this controller, where the logic fails to validate the specific authorization requirements defined by individual plugins when processing POST requests directed at action endpoints. While the architecture correctly implements rigorous access checks for retrieving data via GET requests on the menubar items listing endpoint through a function named userPassesAuthorize(), it neglects to apply equivalent scrutiny to state-changing operations initiated via POST requests targeting actions such as /api/v1/menubar/actions/{plugin}/{action}.
From a technical perspective, this inconsistency creates a significant gap in the security boundary. When an authenticated user with the baseline api.access permission submits a request to invoke a menubar action, the system verifies only that the user possesses general API access rights. It completely omits the evaluation of the authorize field associated with the specific plugin and action being invoked. In standard Grav plugin development, plugins register actions with metadata including authorization requirements to ensure that sensitive operations are restricted to users with appropriate privileges beyond mere API connectivity. By ignoring this metadata during execution, the application allows any authenticated user who can access the API to trigger privileged functions intended for higher-privileged roles or specific administrative contexts. This constitutes a classic broken access control vulnerability where the enforcement mechanism is incomplete and inconsistent across different parts of the same subsystem.
The operational impact of this flaw depends heavily on the configuration of the target Grav installation, particularly regarding installed plugins. In a stock environment with only core bundled components, the immediate risk may appear latent because no default plugin registers actions that require elevated authorization beyond basic API access. However, for any production site utilizing first-party or third-party extensions that rely on the documented authorize semantics to protect sensitive operations, this vulnerability is severe. An attacker who has obtained valid credentials for an account with api.access permissions can exploit this flaw to execute privileged menubar actions without proper justification. This could lead to unauthorized modifications of system settings, execution of administrative commands, or escalation of privileges if a plugin action performs critical backend tasks such as database manipulation, file system changes, or user management operations that are protected by the authorize field but left exposed due to this oversight.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically where an actor is granted permissions they should not have based on their role or context. Furthermore, it maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation relies on using legitimate credentials that are insufficiently scoped for the specific actions being performed. The attack vector involves authenticated users leveraging standard HTTP POST requests against the API endpoint, making detection potentially difficult without detailed logging of authorization decisions versus actual execution outcomes. To mitigate this risk, administrators must upgrade the Grav API plugin to version 1.0.14 or later where the executeAction method has been patched to correctly evaluate and enforce the authorize requirements for all registered actions. Until such an update is applied, organizations should restrict api.access permissions to only those users who absolutely require it and monitor logs for unusual POST activity against menubar action endpoints. Developers integrating custom plugins must also ensure that their authorization logic does not rely solely on endpoint-level checks but implements robust server-side validation of user privileges before executing any state-changing operations.