CVE-2026-62231: Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created with limited scopes (e.g. read-only) can perform any write, delete, or administrative operation the owning user is authorized for. Fixed in 1.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62231?
The severity of CVE-2026-62231 is rated as high with a score of 8.1.
How do I fix CVE-2026-62231?
To fix CVE-2026-62231, you should upgrade the Grav API plugin to version 1.0.6 or later.
What vulnerability does CVE-2026-62231 describe?
CVE-2026-62231 describes an authorization bypass in the Grav API plugin that fails to enforce API key scopes.
What are the potential impacts of CVE-2026-62231?
The potential impacts of CVE-2026-62231 include unauthorized access to a user's full account object through misguided API key configuration.
Which software is affected by CVE-2026-62231?
CVE-2026-62231 affects the Grav API plugin, specifically versions prior to 1.0.6.