CVE-2026-75836 Overview
CVE-2026-75836 is a missing authorization vulnerability [CWE-862] in the Grav API plugin (getgrav/grav-plugin-api), bundled with Grav's admin-next/API stack. Versions before 1.0.14 fail to enforce the authorize requirement in MenubarController::executeAction(). The GET /menubar/items listing endpoint correctly filters items via userPassesAuthorize(), but the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only checks the baseline api.access permission. Any authenticated caller with api.access can invoke a privileged menubar action, bypassing the plugin's declared authorize field.
Critical Impact
Authenticated users holding only api.access can execute privileged menubar actions registered by first- or third-party plugins, bypassing intended authorization checks.
Affected Products
- Grav API plugin (getgrav/grav-plugin-api) prior to version 1.0.14
- Grav CMS installations using the admin-next/API stack that bundles the API plugin
- Any first- or third-party Grav plugin relying on the documented authorize semantics for menubar actions
Discovery Timeline
- 2026-08-18 - CVE-2026-75836 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-75836
Vulnerability Analysis
The Grav API plugin exposes menubar functionality through two endpoints with divergent authorization behavior. The GET /menubar/items endpoint enumerates available items and correctly evaluates each item's authorize field through userPassesAuthorize(). This ensures callers only see items they are permitted to invoke.
The POST /api/v1/menubar/actions/{plugin}/{action} endpoint, implemented in MenubarController::executeAction(), diverges from that contract. It validates only the baseline api.access permission granted to standard API users. It never re-evaluates the per-action authorize field a plugin registered when declaring the menubar entry.
A caller who authenticates and holds api.access can therefore submit a direct POST request to any registered menubar action, including actions the caller would never be shown in the filtered listing. The stock Grav install ships no plugin that registers a privileged authorize handler, so impact is latent on default deployments. Any first- or third-party plugin relying on the documented authorize contract for privilege separation is exposed.
Root Cause
The controller enforces authentication and coarse-grained API access, but omits the fine-grained authorization callback the plugin API contract requires. The listing path and the execution path implement inconsistent security models, violating the principle of complete mediation.
Attack Vector
Exploitation requires network access to the Grav API endpoint and a valid low-privilege account with api.access. The attacker sends a crafted POST to /api/v1/menubar/actions/{plugin}/{action} naming a privileged action registered by an installed plugin. The controller executes the action without consulting the plugin's authorize handler. Refer to the GitHub Security Advisory GHSA-8mjx-xjfv-9c88 and the VulnCheck Advisory on Grav API Plugin for endpoint details.
Detection Methods for CVE-2026-75836
Indicators of Compromise
- POST requests to /api/v1/menubar/actions/{plugin}/{action} originating from accounts that do not appear in the corresponding GET /menubar/items listing.
- API access logs showing menubar action executions by users holding only the baseline api.access permission.
- Unexpected state changes on Grav sites correlated with menubar action invocations rather than authenticated admin UI use.
Detection Strategies
- Audit web server and application logs for HTTP POSTs matching the path pattern /api/v1/menubar/actions/*/* and correlate the acting user against expected role.
- Compare per-user results of GET /menubar/items against successful POST executions to surface actions invoked outside the filtered listing.
- Review installed third-party Grav plugins for menubar actions that declare an authorize field, and flag any invocation by non-authorized principals.
Monitoring Recommendations
- Forward Grav application and web server logs to a centralized analytics platform and alert on menubar action POSTs from low-privilege API accounts.
- Track the installed Grav API plugin version across all sites and alert when it falls below 1.0.14.
- Instrument custom plugins to log the outcome of any authorize callback invocation so bypass attempts are visible.
How to Mitigate CVE-2026-75836
Immediate Actions Required
- Upgrade the Grav API plugin (getgrav/grav-plugin-api) to version 1.0.14 or later on every Grav installation.
- Inventory third-party plugins that register menubar actions with an authorize field and treat them as exposed until the API plugin is patched.
- Rotate or restrict API tokens for accounts holding api.access if abuse of the menubar action endpoint is suspected.
Patch Information
The fix is delivered in Grav API plugin version 1.0.14, which enforces the plugin-declared authorize requirement inside MenubarController::executeAction(). Details are documented in the GitHub Security Advisory GHSA-8mjx-xjfv-9c88.
Workarounds
- Restrict network access to the Grav admin and API endpoints to trusted management networks or VPN ranges.
- Remove or disable the Grav API plugin on sites that do not require programmatic API access until the update is applied.
- Reduce the number of accounts granted the api.access permission and audit remaining accounts for least privilege.
- Front the Grav API with a reverse proxy or web application firewall rule that blocks POST /api/v1/menubar/actions/* from non-administrative users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
