CVE-2026-62667: Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the owning user's complete identity. AbstractApiController::requirePermission() consequently evaluates the full user ACL, so a key issued for a read-only scope can perform every write, delete, and administrative operation available to the owner. This issue is fixed in version 1.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API Pluginto a version that resolves this vulnerability.Fixed in 1.0.6
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the Grav API Plugin before version 1.0.6 are affected if they issue API keys intended to have limited scopes. The impact of a compromised or delegated key depends on the full ACL of the user account that owns it.
What does an attacker need to exploit it?
An attacker needs a valid API key associated with a user account that has permissions beyond the key's declared scope. No user interaction is required, and the attacker can use the owner's full API-accessible privileges.
Are read-only API keys a safe workaround on affected versions?
No. Before 1.0.6, declared scopes are stored but not enforced during authentication or permission checks, so a read-only key retains the owning user's complete ACL.
What should be done if the plugin cannot be updated immediately?
Avoid issuing or delegating API keys for accounts with write, delete, or administrative permissions. Restrict API key ownership to accounts with only the minimum ACL required, and revoke keys that were issued under the assumption that scopes limited their privileges.
How can I determine whether an existing key is affected?
Keys are affected when the plugin version is earlier than 1.0.6 and the key owner has permissions that exceed the key's declared scopes. Review API keys alongside the full ACL of each owning user rather than relying on the scopes recorded for the key.