CVE-2026-65007 Overview
CVE-2026-65007 is a missing authorization vulnerability [CWE-862] in the Grav grav-plugin-api plugin versions prior to 1.0.8. The plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks before the account-management access control list (ACL) executes. It authorizes callers using only the admin.login permission, which every panel user holds by default. Any authenticated panel user can mint or revoke a persistent API key bound to any account. The forged key inherits the target account's API permissions, enabling account impersonation and privilege escalation up to full account takeover.
Critical Impact
Any authenticated Grav admin panel user can forge persistent API keys for higher-privileged accounts, leading to account takeover.
Affected Products
- Grav CMS grav-plugin-api versions before 1.0.8
- Grav installations with the API plugin enabled and multiple panel accounts
- Grav deployments where API-enabled accounts hold broader permissions than baseline users
Discovery Timeline
- 2026-07-21 - CVE-2026-65007 published to the National Vulnerability Database (NVD)
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-65007
Vulnerability Analysis
The Grav API plugin exposes two administrative tasks, apiKeyGenerate and apiKeyRevoke, through the admin panel routing layer. These tasks are handled in the plugin's request pipeline before the account-management ACL evaluates whether the caller has permission to modify the target account. The authorization check performed at this early stage validates only that the caller holds the admin.login permission, which is the baseline capability granted to every user with access to the admin panel.
Any authenticated panel user can submit a crafted request to generate a persistent API key bound to an arbitrary account. The forged key inherits the API permissions of the target account, not those of the caller. On installations where at least one API-enabled account holds elevated permissions, a low-privileged user can escalate to the permission set of that account. The attacker can then perform any operation the impersonated account is authorized to execute through the API surface.
Root Cause
The root cause is a missing authorization check [CWE-862] on the account-scoped identifier passed to apiKeyGenerate and apiKeyRevoke. The plugin conflates authentication with authorization. It confirms the caller can log in but never verifies the caller is entitled to manage keys for the specified account.
Attack Vector
Exploitation requires only network access to the Grav admin panel and any valid low-privileged account. The attacker authenticates, then issues an apiKeyGenerate task request that specifies a higher-privileged account as the key owner. The plugin returns a valid persistent API key. The attacker uses that key to invoke API endpoints as the impersonated account. See the GitHub Security Advisory and the Vulncheck Advisory on Grav for the disclosed technical details.
Detection Methods for CVE-2026-65007
Indicators of Compromise
- Requests to the admin panel invoking the apiKeyGenerate or apiKeyRevoke tasks from accounts that do not own the referenced target account.
- New API keys appearing in the Grav configuration files for accounts that did not initiate the change through legitimate workflows.
- API requests authenticated with newly issued keys originating from IP addresses or user agents inconsistent with the key owner's normal activity.
Detection Strategies
- Audit Grav admin panel access logs for POST requests containing task=apiKeyGenerate or task=apiKeyRevoke and correlate the acting session user against the target account parameter.
- Track file modification events on Grav user account YAML files and alert when API key fields are added or removed outside of change-management windows.
- Baseline API key usage per account and alert on first-use events for newly created keys against sensitive endpoints.
Monitoring Recommendations
- Forward Grav admin panel and web server logs to a centralized logging or SIEM platform for correlation of authorization anomalies.
- Enable file integrity monitoring on the Grav user/accounts/ directory to capture unauthorized key additions.
- Review authentication logs for panel users with admin.login who interact with API key management endpoints.
How to Mitigate CVE-2026-65007
Immediate Actions Required
- Upgrade grav-plugin-api to version 1.0.8 or later on all Grav installations.
- Rotate every existing API key issued through the admin panel, treating pre-patch keys as potentially compromised.
- Review all panel user accounts and remove unnecessary admin.login grants until the plugin is patched.
Patch Information
The Grav maintainers addressed the flaw in grav-plugin-api version 1.0.8 by moving the authorization decision for apiKeyGenerate and apiKeyRevoke behind the account-management ACL. Refer to the GitHub Security Advisory GHSA-7v74-m76q-8wf3 for the fix commit and upgrade instructions.
Workarounds
- Disable the grav-plugin-api plugin until the upgrade to 1.0.8 can be completed.
- Restrict network access to the Grav admin panel to trusted management networks or VPN clients.
- Reduce the permission scope of API-enabled accounts so that a forged key inherits minimal capabilities.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
