CVE-2026-75832 Overview
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) contains a missing authorization vulnerability in the BlueprintPathResolver::resolveUserScope() method. Versions before 1.0.14 gate the users/<name> scope on the account's raw super-admin ACL flag (access.api.super) rather than validating the API key's actual granted scope. An attacker holding an API key scoped only to api.media.write, but minted on a super-admin account, can bypass the check. The flaw is fixed in version 1.0.15. This is a Missing Authorization weakness [CWE-862].
Critical Impact
A restricted API key can write image files into other users' account scopes and enumerate their file listings, despite lacking api.users.write.
Affected Products
- Grav CMS 2.0 (bundled deployments)
- getgrav/grav-plugin-api versions prior to 1.0.14
- Deployments using API keys minted on super-admin accounts with narrow scopes
Discovery Timeline
- 2026-08-18 - CVE-2026-75832 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-75832
Vulnerability Analysis
The Grav API plugin implements scope-based authorization for API keys. Each key is issued specific permissions such as api.media.write or api.users.write. The BlueprintPathResolver::resolveUserScope() method is responsible for validating whether a request targeting the users/<name> blueprint scope should be permitted.
Instead of checking the presented API key's granted scope, the method inspects the underlying account's access.api.super ACL flag. Any API key minted on a super-admin account inherits authorization for the users scope, regardless of the key's declared permissions. This decouples the key's intended least-privilege boundary from the enforcement logic.
Root Cause
The root cause is a confusion between account-level ACL and key-level scope. The resolver treats the account's super-admin flag as sufficient authorization. It never consults the token's scope claim. This is a canonical Missing Authorization pattern where an authenticated principal is not re-authorized against the specific resource and action.
Attack Vector
An attacker with a valid API key scoped to api.media.write on a super-admin account can send a POST /blueprint-upload request targeting another user's scope. The assertSafeExtension() guard constrains uploaded files to image extensions and writes them into the shared user/accounts/ directory. The attacker can also issue GET /blueprint-files to enumerate the target scope's file listing. Both actions succeed without api.users.write, allowing lateral file placement and reconnaissance across user scopes.
No verified exploit code is public. Refer to the GitHub Security Advisory GHSA-435x-66r2-jwv2 and the VulnCheck Advisory for technical details.
Detection Methods for CVE-2026-75832
Indicators of Compromise
- Requests to POST /blueprint-upload or GET /blueprint-files where the target path resolves under a different user's scope than the key owner.
- Unexpected image files appearing in user/accounts/<other-user>/ directories that do not match legitimate administrative activity.
- API keys scoped to api.media.write generating traffic against users/<name> blueprint endpoints.
Detection Strategies
- Correlate API key identifiers with the scope claims presented in each request and flag mismatches between key scope and endpoint category.
- Baseline normal blueprint endpoint usage per API key and alert on new keys accessing users/<name> scopes.
- Review web server logs for blueprint-upload and blueprint-files calls issued by non-super-admin operational workflows.
Monitoring Recommendations
- Enable verbose audit logging on the Grav API plugin and forward events to a centralized log platform.
- Monitor filesystem changes under user/accounts/ for writes originating from API-initiated processes.
- Track creation and modification times of image files in per-user account directories against expected administrative changes.
How to Mitigate CVE-2026-75832
Immediate Actions Required
- Upgrade getgrav/grav-plugin-api to version 1.0.15 or later, which corrects the scope check in BlueprintPathResolver::resolveUserScope().
- Rotate all API keys minted on super-admin accounts, especially keys with narrow scopes such as api.media.write.
- Audit user/accounts/ directories for unexpected image files placed by API activity.
Patch Information
The vulnerability is fixed in getgrav/grav-plugin-api version 1.0.15. Version 1.0.14 and earlier remain vulnerable. Consult the GitHub Security Advisory GHSA-435x-66r2-jwv2 for the corrected authorization logic and upgrade guidance.
Workarounds
- Avoid minting API keys on super-admin accounts; provision dedicated non-super-admin accounts for automation.
- Restrict network exposure of the Grav API plugin endpoints behind an authenticated reverse proxy while upgrading.
- Temporarily disable the blueprint-upload and blueprint-files routes if upgrade cannot be applied immediately.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
