CVE-2026-62666: Grav API Plugin Auth Bypass Vulnerability

CVE-2026-62666 Overview

CVE-2026-62666 is a broken access control vulnerability in the Grav API Plugin, a RESTful API providing headless access to Grav CMS content. Versions prior to 1.0.6 fail to enforce the accessGrantsSuper() target check in three UsersController endpoints: createApiKey(), generate2fa(), and disable2fa(). An authenticated non-super account holding the api.users.write permission can mint an API key bound to a super-administrator target and inherit that target's full privileges. The same missing check enables rotation or disablement of another account's two-factor authentication. This flaw is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

Critical Impact
A low-privileged authenticated user can escalate to persistent super-administrator access and disable 2FA on privileged accounts.

Affected Products

Grav API Plugin versions prior to 1.0.6
Grav CMS installations exposing the API plugin
Deployments granting api.users.write to non-super accounts

Discovery Timeline

2026-08-19 - CVE-2026-62666 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-62666

Vulnerability Analysis

The Grav API Plugin exposes user-mutation endpoints that are supposed to verify whether the caller is authorized to act on a target account. Sibling endpoints correctly invoke accessGrantsSuper() to prevent a non-super account from modifying a super-administrator target. The three affected endpoints, createApiKey(), generate2fa(), and disable2fa(), omit that guard.

The attack chain combines two defects. First, the missing target check lets a caller invoke requireApiKeyPermission() against a super-admin target. Second, key scopes are not enforced at authorization time, so a newly minted key inherits the full ACL of its owning account rather than the scopes declared at creation. The result is that a scoped, low-privileged key mints an unscoped credential bound to a privileged identity.

Successful exploitation yields persistent super-administrator access through a durable API key. The same weakness permits an attacker to rotate or disable two-factor authentication on the targeted account, undermining a common recovery control.

Root Cause

The root cause is inconsistent authorization enforcement across sibling controller methods. UsersController::createApiKey(), generate2fa(), and disable2fa() do not call the accessGrantsSuper() predicate used by neighboring mutation endpoints. Additionally, ApiKeyAuthenticator did not surface the key's scope set to requirePermission(), so scope-based capping was absent.

Attack Vector

Exploitation requires network access to the API endpoint and a valid account with api.users.write. The attacker issues an authenticated request to create an API key targeting a super-admin user. The returned key carries access.api.super and can be used immediately to perform administrative actions.

php

// Security patch in classes/Api/Controllers/AbstractApiController.php
// Enforces API-key scope cap BEFORE the super-admin short-circuit
$scopes = $request->getAttribute('api_key_scopes');
if (is_array($scopes) && $scopes !== [] && !$this->scopesPermit($scopes, $permission)) {
    throw new ForbiddenException("API key is not authorized for: {$permission}");
}

// Super admin can do anything
if ($this->isSuperAdmin($user)) {
    return;
}

Source: GitHub Commit dfcc947

The companion patch in ApiKeyAuthenticator.php introduces a request-local $authenticatedScopes property so AuthMiddleware can stamp the request with api_key_scopes, enabling the scope cap shown above.

Detection Methods for CVE-2026-62666

Indicators of Compromise

API key creation events targeting super-administrator accounts by non-super callers
New API keys with access.api.super grants issued outside expected administrative workflows
2FA reset or disable events on privileged accounts without corresponding administrator sessions
Unexpected POST requests to UsersController endpoints for createApiKey, generate2fa, or disable2fa

Detection Strategies

Audit Grav plugin logs for createApiKey calls where the target user differs from the caller and holds elevated roles
Correlate API key mint events with subsequent super-admin actions performed by the newly issued key
Flag any invocation of generate2fa() or disable2fa() targeting an account other than the caller's own

Monitoring Recommendations

Enable verbose access logging on the Grav API Plugin and forward logs to a central store
Alert on any 2FA state changes on privileged accounts
Track the inventory of active API keys and their declared scopes, alerting on new unscoped keys

How to Mitigate CVE-2026-62666

Immediate Actions Required

Upgrade the Grav API Plugin to version 1.0.6 or later
Revoke and rotate all existing API keys, particularly those bound to super-administrator accounts
Review the api.users.write grant and remove it from non-super accounts where possible
Re-enroll two-factor authentication on any account whose 2FA state cannot be verified as intact

Patch Information

The fix is available in Grav API Plugin 1.0.6. The patch introduces API key scope enforcement in AbstractApiController, exposes authenticated scopes through ApiKeyAuthenticator, and adds the missing super-admin target guard. See the GitHub Release 1.0.6 and GHSA-8gg4-rvvv-cq96 for details.

Workarounds

Restrict api.users.write to trusted super-administrator accounts until patching is complete
Disable the Grav API Plugin entirely if user-management endpoints are not required
Place the API endpoint behind network ACLs limiting access to known administrative IPs

bash

# Update the Grav API plugin via the Grav CLI
bin/gpm update api

# Verify the installed version is 1.0.6 or later
bin/gpm info api | grep -i version