CVE-2026-62231: Grav API Plugin Auth Bypass Vulnerability

CVE-2026-62231 Overview

CVE-2026-62231 is an authorization bypass vulnerability in the Grav API plugin (getgrav/grav-plugin-api) affecting versions before 1.0.6. API keys support a scopes array intended to restrict what actions each key can perform. The ApiKeyAuthenticator class never reads or enforces these scopes. Instead, it loads and returns the owning user's full account object, granting any authenticated key the complete permission set of its owner. A read-only key can therefore perform write, delete, or administrative operations. The flaw is classified as Incorrect Authorization [CWE-863] and is fixed in version 1.0.6.

Critical Impact
Any API key issued with restricted scopes gains the full privileges of its owning user, enabling unauthorized write, delete, and administrative actions against the Grav instance.

Affected Products

Grav API plugin (getgrav/grav-plugin-api) versions prior to 1.0.6
Grav CMS deployments that expose the API plugin to network clients
Any integration or automation relying on scope-limited Grav API keys

Discovery Timeline

2026-07-17 - CVE-2026-62231 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-62231

Vulnerability Analysis

The Grav API plugin issues API keys that can be provisioned with a scopes array to constrain their capabilities, for example limiting a key to read-only endpoints. Authentication is handled by the ApiKeyAuthenticator class, which resolves an incoming key to its owning user and returns that user's account object to downstream request handlers. The authenticator does not read the scopes field on the key and does not evaluate it against the requested route or action. Downstream authorization checks rely on the returned user object, so every request executes with the user's native privileges. An attacker in possession of a low-scope key can invoke administrative endpoints as if they held a full-privilege session.

Root Cause

The root cause is missing enforcement logic in ApiKeyAuthenticator. The scope metadata persisted with each key is never consulted during request authorization. This is a classic broken access control pattern where authentication succeeds but scope-based authorization is silently skipped [CWE-863].

Attack Vector

Exploitation requires network access to the Grav API endpoints and possession of a valid API key with any scope. An attacker who obtains a scope-restricted key, whether through legitimate issuance, credential leakage, or compromise of an integration partner, can issue arbitrary API calls. Requests targeting privileged routes succeed because the authenticator returns the owner's full account object rather than a scope-limited principal. No user interaction is required.

Refer to the GitHub Security Advisory GHSA-x7hm-jc32-v39j and the VulnCheck Advisory for vendor technical detail.

Detection Methods for CVE-2026-62231

Indicators of Compromise

API requests from a single key hitting endpoints outside its declared scope, for example a read-only key issuing POST, PUT, or DELETE calls.
Administrative actions in Grav audit logs attributed to accounts that normally interact only through scope-limited integrations.
Unexpected content, user, or configuration changes correlated with API key activity rather than interactive admin sessions.

Detection Strategies

Inventory all issued Grav API keys and compare their declared scopes against the HTTP methods and paths observed in access logs.
Alert on any Grav API request where the invoked route exceeds the intended scope of the authenticating key.
Review Grav plugin version metadata across environments to identify hosts still running versions prior to 1.0.6.

Monitoring Recommendations

Forward Grav web server and application logs into a centralized analytics platform and retain API authentication events for correlation.
Baseline normal API usage per key and generate anomalies on privilege deviations, off-hours use, or new source IP addresses.
Monitor changes to user/accounts/*.yaml, plugin configuration files, and page content for modifications originating from API sessions.

How to Mitigate CVE-2026-62231

Immediate Actions Required

Upgrade the Grav API plugin to version 1.0.6 or later on every Grav instance.
Rotate all existing API keys after patching, since prior scope claims cannot be trusted retroactively.
Audit recent API activity for actions inconsistent with each key's intended scope and remediate any unauthorized changes.

Patch Information

The issue is fixed in getgrav/grav-plugin-api version 1.0.6, which introduces scope enforcement within the ApiKeyAuthenticator path. Administrators should apply the update through the Grav plugin manager or by pulling the tagged release from the upstream repository. Consult the GitHub Security Advisory GHSA-x7hm-jc32-v39j for release details.

Workarounds

Restrict network exposure of the Grav API to trusted management networks or a VPN until patching completes.
Revoke API keys associated with lower-trust integrations and reissue them only after upgrading to 1.0.6.
Enforce least privilege at the user account level, since a compromised key inherits the owner's privileges rather than the key's declared scope on vulnerable versions.

bash

# Configuration example
# Upgrade the Grav API plugin to the fixed release
cd /path/to/grav
bin/gpm update api
bin/gpm info api  # verify version is 1.0.6 or later