getgrav Grav up to 1.0.13 MenubarController executeAction improper authorization

Summaryinfo

A vulnerability was found in getgrav Grav up to 1.0.13. It has been declared as critical. Affected is the function MenubarController::executeAction of the component MenubarController. Such manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-75836. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in getgrav Grav up to 1.0.13. It has been rated as critical. Affected by this issue is the function MenubarController::executeAction of the component MenubarController. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize(), the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only checks the baseline api.access permission and never evaluates the authorize field a plugin registered for that action. Any authenticated caller with api.access can therefore invoke a privileged menubar action directly, bypassing the intended authorization. No plugin bundled with core Grav currently registers a privileged authorize handler, so on a stock install the impact is latent; the flaw affects any first- or third-party plugin relying on the documented authorize semantics.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-75836 since 08/18/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 1.0.14 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CNNVD (CNNVD-2026-99333949). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• getgrav

Name

• Grav

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13

Website

• Product: https://github.com/getgrav/grav/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion