CVE-2026-64852: Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API Pluginto a version that resolves this vulnerability.Fixed in 1.0.8
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with the admin.login permission can exploit it. The user does not need to already hold the target account's API or administrative permissions.
What access can an attacker gain through a forged key?
The attacker can generate a persistent API key for another account and receive that account's API permissions. If the target has api.super or administrative write access, the forged key inherits those privileges.
Are default deployments affected?
Deployments are affected when they use a version of the Grav API Plugin prior to 1.0.8 and have a user that can authenticate with admin.login. Exposure is especially significant where higher-privileged accounts have API permissions.
What should be done if immediate patching is not possible?
Restrict admin.login to only fully trusted users and review which accounts have API permissions, particularly api.super or administrative write access. Rotate or revoke API keys for privileged accounts if unauthorized key generation is suspected.
How can administrators check for possible exploitation?
Review API keys associated with privileged accounts for credentials that were not expected or authorized. Because the vulnerable tasks can create persistent credentials for a selected target account, investigate any unexplained keys bound to those accounts.