CVE-2026-64852: Grav API Plugin Auth Bypass Vulnerability

CVE-2026-64852 Overview

CVE-2026-64852 is a missing authorization vulnerability [CWE-862] in the Grav API Plugin, a RESTful API for Grav CMS providing headless access to site content. Versions prior to 1.0.8 intercept the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php while authorizing the caller with only admin.login. Any basic panel user can select another account from the route and mint a persistent ApiKeyManager credential bound to that target. The forged key inherits the target account's API permissions, including api.super or administrative write access. The issue is fixed in version 1.0.8.

Critical Impact
A low-privileged panel user can forge persistent API keys bound to any account, including super-admin accounts, and inherit their full API privileges.

Affected Products

Grav CMS API Plugin versions prior to 1.0.8
Grav CMS instances with the API plugin enabled and multiple admin panel users
Deployments exposing the admin panel to network-reachable users with admin.login

Discovery Timeline

2026-08-19 - CVE-2026-64852 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-64852

Vulnerability Analysis

The Grav API Plugin exposes two admin tasks, apiKeyGenerate and apiKeyRevoke, that manage ApiKeyManager credentials used for headless access. Before version 1.0.8, the request handler in user/plugins/api/api.php intercepts these tasks and checks only that the session user holds the admin.login permission. The permission gate does not compare the acting user against the account named in the route. This allows any authenticated panel user to specify another account as the target and mint a durable API key bound to that account. The forged credential carries the target's API permission set, so a caller with admin.login alone can obtain keys granting api.super or write access to site content. The vulnerability maps to CWE-862 (Missing Authorization).

Root Cause

The root cause is an incomplete authorization check on account-management operations. The admin task handler required only baseline session authentication and never verified that the caller was permitted to manage credentials for the selected target account. Minting or revoking keys for another user is an account-management action that should require admin.users or admin.super, and non-super callers should never be able to target a super-admin account.

Attack Vector

An attacker with any valid Grav admin panel account submits a crafted request to the apiKeyGenerate task, specifying another user, including a super-admin, as the target. The server issues a persistent API key bound to that identity. The attacker then authenticates to the REST API with the forged key and executes any operation permitted to the target account, including administrative writes.

php

            $this->outputJson(['status' => 'error', 'message' => 'Not authorized.']);
        }

+        // Authorize the caller against the target account. admin.login is the
+        // baseline permission every panel user holds; on its own it only grants
+        // management of the caller's OWN keys. Minting or revoking keys for any
+        // other account is an account-management operation and requires
+        // admin.users / admin.super, and only a super-admin may target a
+        // super-admin account. Without this gate an admin.login user could forge
+        // a persistent key bound to any account and inherit its API permissions.
+        // Mirrors the REST path's requireApiKeyPermission + requireNotSuperTarget.
+        // (GHSA-7v74-m76q-8wf3)
+        $this->authorizeApiKeyTarget($user);
+
        match ($task) {
            'apiKeyGenerate' => $this->handleApiKeyGenerate(),
            'apiKeyRevoke' => $this->handleApiKeyRevoke(),
        };

Source: GitHub Commit ed16f0a — this patch inserts authorizeApiKeyTarget($user) before dispatching either task, enforcing that the caller may manage keys for the named account.

Detection Methods for CVE-2026-64852

Indicators of Compromise

Admin panel access log entries invoking the apiKeyGenerate or apiKeyRevoke tasks where the acting session user differs from the target account in the route.
Newly created ApiKeyManager entries bound to super-admin accounts that were not initiated by that account.
Unexpected API activity authenticated with keys tied to super-admin identities but originating from source addresses previously associated with lower-privileged users.

Detection Strategies

Audit stored ApiKeyManager credentials across all accounts and correlate creation timestamps with admin session logs to confirm the acting user matches the target.
Alert on any HTTP POST to admin task endpoints handling apiKeyGenerate or apiKeyRevoke where the route account is not the session account.
Monitor for API requests using keys whose scopes include api.super and validate against an allow list of expected issuers.

Monitoring Recommendations

Enable verbose admin panel logging for task dispatch and forward events to a centralized log store for retention and correlation.
Track privileged API operations, including content writes and user management, and flag activity performed by keys created after the plugin was deployed but before the upgrade to 1.0.8.

How to Mitigate CVE-2026-64852

Immediate Actions Required

Upgrade the Grav API Plugin to version 1.0.8 or later on all Grav CMS instances.
Revoke and reissue every existing ApiKeyManager credential to invalidate any keys that may have been forged before patching.
Review admin panel user accounts and remove or restrict any accounts that do not require API access.

Patch Information

The vendor released version 1.0.8 of the Grav API Plugin, which adds an authorizeApiKeyTarget() check before dispatching the apiKeyGenerate and apiKeyRevoke tasks. The check requires admin.users or admin.super to act on another account and blocks non-super callers from targeting super-admin accounts. See the GitHub Release Version 1.0.8 and GitHub Security Advisory GHSA-7v74-m76q-8wf3.

Workarounds

Restrict admin panel access at the network layer to trusted operators until the plugin can be upgraded to 1.0.8.
Disable the Grav API Plugin entirely if headless API access is not required in the environment.
Limit the number of accounts with admin.login to reduce the population of users able to reach the vulnerable task handler.

bash

# Upgrade the Grav API plugin using the Grav GPM CLI
bin/gpm update api

# Confirm the installed version is 1.0.8 or later
bin/gpm info api

# Optional: disable the plugin if API access is not required
bin/plugin api uninstall