Executive Summary
A critical broken authorization vulnerability (CVE-2026-65007) has been disclosed in the Grav CMS API plugin (grav-plugin-api). Carrying a CVSS score of 9.6, the flaw allows any authenticated user with only the baseline admin.login permission to generate or revoke API keys — including those belonging to higher-privileged accounts — bypassing the account-management ACL entirely.
CVSS Score: 9.6 (Critical)
The vulnerability stems from the plugin intercepting apiKeyGenerate and apiKeyRevoke admin tasks before the full account-management access control layer runs, checking only whether the caller holds the admin.login permission rather than the full account-management permission required to modify API keys. This allows privilege escalation through API key manipulation. The fix is available in grav-plugin-api 1.0.8.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-65007 |
| CVSS Score | 9.6 (Critical) |
| Type | Broken Access Control (CWE-862) |
| Attack Vector | Network |
| Privileges Required | Low (admin.login only) |
| User Interaction | None |
| Scope | Changed |
| Affected Component | grav-plugin-api API key management |
Affected Versions
| Component | Affected Versions | Fixed Version |
|---|---|---|
| grav-plugin-api | < 1.0.8 | 1.0.8 |
Technical Analysis
Grav CMS uses a layered ACL system where different administrative operations require specific permissions. API key generation and revocation should require the admin.account (or equivalent account-management) permission. However, the API plugin hooks into the admin task lifecycle and processes apiKeyGenerate and apiKeyRevoke tasks before the ACL middleware validates the caller's full permission set.
Because the plugin only checks for admin.login — the permission any authenticated admin user holds — any low-privilege admin can:
- Generate new API keys for any account, including superadmin accounts
- Revoke existing API keys to lock out legitimate users
- Potentially escalate privileges by generating their own high-privilege API keys
Exploit Scenario:
1. Low-privilege admin user authenticates to Grav admin panel
2. User crafts POST request to admin task endpoint:
POST /admin/task/apiKeyGenerate?account=admin
3. Plugin processes request before ACL check completes
4. New API key generated for the admin account
5. Attacker uses API key for full admin API access
Authorization Gap
| Operation | Required Permission (intended) | Checked Permission (vulnerable) |
|---|---|---|
| apiKeyGenerate | admin.account | admin.login only |
| apiKeyRevoke | admin.account | admin.login only |
Immediate Remediation
Step 1: Upgrade grav-plugin-api to 1.0.8
# Via Grav CLI
bin/gpm update api
# Or download the release package from the Grav repository
# and replace the /user/plugins/api directoryVerify the installed version in /user/plugins/api/api.yaml — confirm version: 1.0.8 or higher.
Step 2: Audit Existing API Keys
After patching, audit all API keys for unexpected entries:
- Navigate to Admin Panel > Users
- Review each user's API keys for unrecognized entries
- Revoke all API keys and reissue to known legitimate users
- Rotate any credentials accessible via the compromised API keys
Step 3: Review Admin User Permissions
# Check which users have admin.login access
grep -r "admin.login" /path/to/grav/user/accounts/Ensure the principle of least privilege: only users who genuinely need admin panel access should hold admin.login.
If Immediate Patching Is Not Possible
- Disable the API plugin (
bin/gpm disable api) until patched - Block admin panel access (
/admin) to trusted IP ranges via WAF or web server config - Monitor admin task endpoints for unexpected apiKeyGenerate/apiKeyRevoke calls
- Rotate all existing API keys as a precaution
Detection Indicators
| Indicator | Description |
|---|---|
| Unexpected API keys on admin accounts | Signs of key generation exploitation |
| POST requests to apiKeyGenerate/apiKeyRevoke | Active exploitation attempts |
| API authentication from unexpected IPs | Keys used after generation |
| Admin activity by low-privilege accounts | Attacker testing scope of access |
Post-Remediation Checklist
- Confirm plugin updated to 1.0.8+
- Revoke and reissue all API keys across all user accounts
- Review admin user roster — remove unnecessary admin.login grants
- Enable admin panel IP restriction for defense-in-depth
- Check access logs for historical apiKeyGenerate/apiKeyRevoke calls from non-superadmin users
- Test authorization boundaries by attempting the operation as a low-privilege user