CVE-2026-65007: Grav before 1.0.8 Missing Authorization on API Key Generation
The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65007?
CVE-2026-65007 has a critical severity rating of 9.6.
What vulnerability does CVE-2026-65007 address?
CVE-2026-65007 addresses a missing authorization issue in Grav before version 1.0.8 for API key generation.
How do I fix CVE-2026-65007?
To fix CVE-2026-65007, you should upgrade the grav-plugin-api to version 1.0.8 or later.
What impact does CVE-2026-65007 have on my system?
CVE-2026-65007 allows unauthorized users to generate or revoke API keys, potentially compromising your system's security.
Is there a workaround for CVE-2026-65007?
No official workaround exists for CVE-2026-65007; the recommended action is to update to the latest version.