CVE-2026-80204: Grav API Plugin Privilege Escalation Flaw

CVE-2026-80204 Overview

The Grav API plugin (getgrav/grav-plugin-api) before version 1.0.18 contains a broken authorization flaw [CWE-863]. The injectSecurityTab() function in BlueprintController fails to apply API-key scope caps when determining whether a page's security and permissions blueprint section is editable. Raw isSuperAdmin() and hasPermission() checks execute without a request parameter, preventing scopeAllows() enforcement. A caller holding a scoped API key can view, and potentially modify, page permission fields that exceed the granted scope.

Critical Impact
Attackers with a low-scope API key may escalate access to page permission fields outside the intended scope, undermining tenant and role boundaries in Grav installations.

Affected Products

Grav CMS API plugin (getgrav/grav-plugin-api)
Versions before 1.0.18
Deployments exposing scoped API keys to untrusted callers

Discovery Timeline

2026-08-26 - CVE-2026-80204 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80204

Vulnerability Analysis

Grav is a flat-file content management system (CMS). Its API plugin issues scoped API keys that should restrict callers to a defined subset of administrative operations. The plugin exposes a BlueprintController responsible for rendering blueprint sections, including the security and permissions tab of a page.

The defect resides in injectSecurityTab(). The function decides whether to render the security tab by calling isSuperAdmin() and hasPermission() directly on the current user. It does not receive the active request object, so it cannot consult scopeAllows() to evaluate whether the caller's API key scope permits access to permission fields. The check therefore reflects the underlying user's raw role, not the effective scope of the presented API key.

A caller holding a scoped API key inherits the user's role but should be capped by the key's declared scope. Because the cap is skipped, the caller receives permission fields intended only for broader-scoped keys. The reporter did not fully confirm end-to-end write behavior, but read exposure of sensitive permission fields is confirmed.

Root Cause

The root cause is a missing authorization check [CWE-863]. Scope enforcement in Grav depends on scopeAllows(), which requires request context. injectSecurityTab() was implemented without accepting the request, so scope evaluation was silently omitted from the code path.

Attack Vector

An attacker with network access to the Grav admin API and a valid scoped API key issues a request that triggers blueprint rendering for a page. The response includes the security and permissions blueprint section that should have been suppressed. Depending on downstream write paths, the caller may then submit modifications to permission fields outside the intended scope. See the GitHub Security Advisory and the VulnCheck Advisory on Grav for further detail.

No verified proof-of-concept code has been published. The exploitation mechanism is described in prose because verified code examples are not available.

Detection Methods for CVE-2026-80204

Indicators of Compromise

Requests to Grav admin API blueprint endpoints from clients presenting scoped API keys that should not access permission fields.
Responses containing security or permissions blueprint sections returned to callers with restricted scopes.
Unexpected changes to page-level permission metadata authored by API-key identities rather than interactive administrators.

Detection Strategies

Enable verbose logging on the Grav API plugin and correlate API key identifiers with the blueprint sections returned in each response.
Compare rendered blueprint fields against the declared scope of each API key and alert when permission fields appear for out-of-scope keys.
Track modifications to page frontmatter permission entries and flag edits initiated by API-key sessions.

Monitoring Recommendations

Forward Grav application logs and reverse-proxy access logs to a centralized log platform for retention and correlation.
Baseline normal API-key usage patterns and alert on deviations in accessed endpoints or fields.
Review Git history or file integrity monitoring output for unexpected changes to pages/ YAML permission blocks.

How to Mitigate CVE-2026-80204

Immediate Actions Required

Upgrade the Grav API plugin to version 1.0.18 or later on all production and staging instances.
Rotate all scoped API keys after the upgrade and audit their assigned scopes.
Restrict network exposure of the Grav admin API to trusted management networks pending patch validation.

Patch Information

Update getgrav/grav-plugin-api to version 1.0.18 or later. The fix passes the request context into injectSecurityTab() so that scopeAllows() can enforce API-key scope caps before rendering the security and permissions blueprint section. Refer to the GitHub Security Advisory GHSA-mcx6-4rvg-7r8v for the authoritative fix reference.

Workarounds

Revoke or narrow all scoped API keys until the plugin is upgraded, limiting the population of callers that can trigger the vulnerable path.
Place the Grav admin interface behind an authenticated reverse proxy or VPN to reduce the network attack surface.
Disable the API plugin entirely on instances that do not require programmatic administration.

bash

# Configuration example: upgrade the Grav API plugin via the bin/gpm tool
bin/gpm update api
bin/gpm info api  # confirm installed version is >= 1.0.18