CVE-2026-80203 Overview
CVE-2026-80203 is an authorization bypass in the getgrav/grav-plugin-api plugin before version 1.0.18. The requireNotSuperTarget() function in UsersController.php fails to enforce API-key scope across seven sensitive user-management endpoints. The check calls isSuperAdmin() on the acting account instead of isSuperWithinScope(), which would verify the specific API key's authority. An API key scoped below full super authority, but issued under a super-admin account, can therefore act against other super-admin accounts. The flaw maps to CWE-863: Incorrect Authorization.
Critical Impact
A scoped API key can disable 2FA on other super-admin accounts, delete their avatars, mint new API keys under their identity, or delete their existing API keys.
Affected Products
- getgrav/grav-plugin-api versions prior to 1.0.18
- Grav CMS installations that expose the API plugin
- Deployments issuing scoped API keys under super-admin accounts
Discovery Timeline
- 2026-08-26 - CVE-2026-80203 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-80203
Vulnerability Analysis
The vulnerability is an authorization flaw in the Grav API plugin's user-management controller. Seven sensitive endpoints call requireNotSuperTarget() to prevent lower-privileged actors from modifying super-admin users. That guard resolves privilege by inspecting the underlying account with isSuperAdmin(). It never inspects the scope attached to the API key that authenticated the request.
When a super-admin account issues a scoped API key intended for narrower access, the key inherits the account's identity for privilege checks. The scope is stored but not consulted at the enforcement point. An attacker holding such a scoped key can therefore invoke endpoints that should be reserved for full super authority.
Exploitation targets account-security primitives directly. The attacker can disable two-factor authentication on another super-admin, delete that user's avatar, delete their existing API keys, or mint new API keys under their identity. Minting new keys yields durable, attacker-controlled credentials that survive password rotation.
Root Cause
The root cause is an incorrect authorization check (CWE-863). requireNotSuperTarget() evaluates the account's role rather than the effective scope of the presented API key. The correct check, isSuperWithinScope(), is not invoked, so scope restrictions are silently ignored on the affected endpoints.
Attack Vector
Exploitation is remote and network-based. The attacker needs a valid scoped API key that was issued under a super-admin account. No user interaction is required. Requests are issued directly against the seven affected user-management endpoints exposed by the Grav API plugin.
See the GitHub Security Advisory GHSA-94q7-vrqr-cx5v and the VulnCheck advisory for the endpoint list and reproduction details.
Detection Methods for CVE-2026-80203
Indicators of Compromise
- Unexpected API key creation events tied to super-admin accounts, especially originating from a scoped key.
- Sudden 2FA disablement events on super-admin accounts without corresponding administrative action.
- Deletion of API keys or avatars on super-admin accounts initiated by a non-super-scoped key.
- API activity from grav-plugin-api endpoints under UsersController.php invoked with mismatched key scope and target user role.
Detection Strategies
- Audit Grav API logs for calls to the seven user-management endpoints guarded by requireNotSuperTarget() where the calling key is scoped but the target is a super-admin.
- Compare each request's API key scope to the privilege of the target user; alert on mismatches.
- Enumerate all currently valid API keys and flag any created after the earliest suspected exposure window.
Monitoring Recommendations
- Forward Grav application and web server logs to a central analytics platform and retain them for post-incident review.
- Alert on any change to 2FA state, API key inventory, or user metadata for super-admin accounts.
- Monitor outbound requests from the Grav host for signs of follow-on abuse using minted API keys.
How to Mitigate CVE-2026-80203
Immediate Actions Required
- Upgrade getgrav/grav-plugin-api to version 1.0.18 or later on all Grav instances.
- Rotate every API key issued under any super-admin account, including scoped keys.
- Re-enable and verify 2FA on every super-admin account and review recent authentication events.
- Review the API key inventory and remove any keys that cannot be attributed to a legitimate operator.
Patch Information
The fix is included in getgrav/grav-plugin-api version 1.0.18, which routes the check through isSuperWithinScope() so that API key scope is honored on the affected endpoints. Refer to the GitHub Security Advisory GHSA-94q7-vrqr-cx5v for patch metadata and the VulnCheck advisory for additional context.
Workarounds
- Do not issue scoped API keys under super-admin accounts until the upgrade is applied.
- Restrict network access to the Grav administrative and API endpoints to trusted management networks.
- Temporarily disable the API plugin on instances where patching is not immediately possible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
