CVE-2026-62666: Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApiKeyPermission(), obtain the target's full privileges because key scopes are not enforced, and create persistent super-administrator access; the same missing check also permits rotating or disabling the target's two-factor authentication. This issue is fixed in version 1.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API Plugin for Grav CMSto a version that resolves this vulnerability.Fixed in 1.0.6Patch CVE-2026-59190
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated non-super account that has the api.users.write permission can exploit the affected API endpoints. The issue affects Grav API Plugin versions prior to 1.0.6.
What access can an attacker gain?
The attacker can create an API key associated with an access.api.super target and obtain that target's full privileges because key scopes are not enforced. This can result in persistent super-administrator access.
Can an attacker interfere with an administrator's two-factor authentication?
Yes. The missing super-target check in generate2fa() and disable2fa() permits the attacker to rotate or disable the target user's two-factor authentication.
What should be done to remediate the issue?
Upgrade the Grav API Plugin to version 1.0.6, which fixes the missing accessGrantsSuper() target checks in the affected endpoints.