CVE-2026-75835 Overview
The Grav API plugin (getgrav/grav-plugin-api) before version 1.0.14 contains a missing authorization vulnerability [CWE-862] in the userPassesAuthorize() function within AbstractApiController.php. The function fails to consult the calling request's API key scopes. It relies instead on the account's raw super-admin flag and Access Control List (ACL) grants. An authenticated attacker holding a scoped API key minted on a privileged account can bypass declared scope restrictions. This bypass exposes authorize-gated UI metadata and item definitions that the key scope should deny.
Critical Impact
Scoped API keys inherit the underlying account's privileges, allowing authenticated attackers to enumerate sidebar, menubar, widget items, and users-list metadata that should be denied by scope.
Affected Products
- Grav API plugin (getgrav/grav-plugin-api) versions before 1.0.14
- Grav CMS deployments using the API plugin with scoped API keys minted on privileged accounts
- Environments delegating authorization decisions to userPassesAuthorize() in AbstractApiController.php
Discovery Timeline
- 2026-08-18 - CVE-2026-75835 published to the National Vulnerability Database (NVD)
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-75835
Vulnerability Analysis
The Grav API plugin exposes authorize-gated endpoints that return UI metadata and item definitions. These endpoints include sidebar entries, menubar entries, widget items, and users-list columns, row-actions, and filter-tabs. Access to these endpoints is guarded by userPassesAuthorize() in AbstractApiController.php.
The function evaluates authorization against the account's super-admin flag and ACL grants. It does not evaluate the API key scopes attached to the calling request. Any scoped API key minted on a super-admin or ACL-privileged account therefore inherits the account's full authorization surface.
The result is information disclosure of administrative UI metadata that the scope was intended to restrict. Attackers gain visibility into administrative structures, user management columns, and available row-level actions.
Root Cause
The defect is a missing authorization check [CWE-862]. The userPassesAuthorize() implementation treats the API key as an authentication artifact only. It never enforces the scope claims declared on the key. Scope enforcement is decoupled from the authorization decision, producing an incomplete access control model.
Attack Vector
An attacker requires a valid scoped API key issued from a privileged account. The attacker sends authenticated HTTP requests to authorize-gated endpoints that the key's scope should deny. The plugin returns the requested UI metadata and item definitions. No user interaction is required, and the attack is exploitable over the network.
See the GitHub Security Advisory GHSA-p57v-xhv3-mf2w and the VulnCheck Advisory on Grav API for endpoint-specific technical details.
Detection Methods for CVE-2026-75835
Indicators of Compromise
- Authenticated API requests from scoped keys hitting authorize-gated endpoints returning sidebar, menubar, or widget metadata.
- API access logs showing scoped keys retrieving users-list columns, row-actions, or filter-tabs outside their intended scope.
- Unexpected enumeration patterns from a single API key across administrative UI metadata endpoints.
Detection Strategies
- Audit the Grav API plugin version across all deployments and flag any instance below 1.0.14.
- Correlate API key identifiers with the endpoints they access and compare against the declared scope claims.
- Review web server and application logs for high-volume metadata requests originating from non-admin scoped keys.
Monitoring Recommendations
- Enable verbose request logging on the Grav API plugin to capture key identifiers, requested paths, and response sizes.
- Alert on scoped API keys accessing endpoints tied to userPassesAuthorize() outside baseline patterns.
- Track issuance and use of API keys minted on super-admin or ACL-privileged accounts.
How to Mitigate CVE-2026-75835
Immediate Actions Required
- Upgrade the Grav API plugin to version 1.0.14 or later on every affected instance.
- Rotate all scoped API keys issued from super-admin or ACL-privileged accounts before or immediately after upgrading.
- Inventory active API keys and revoke keys that cannot be tied to a documented owner and scope.
Patch Information
The vendor addressed the missing authorization in Grav API plugin version 1.0.14. The fix updates userPassesAuthorize() in AbstractApiController.php to enforce API key scopes in the authorization decision. Refer to the GitHub Security Advisory GHSA-p57v-xhv3-mf2w for release notes and commit references.
Workarounds
- Mint API keys only from non-privileged accounts with the minimum ACL grants required for the workflow.
- Restrict network access to the Grav API endpoints using upstream proxies, IP allowlists, or web application firewall rules.
- Disable the Grav API plugin on instances where scoped API keys are not required until the upgrade is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
