CVE-2026-75832: Grav API Plugin before 1.0.14 Authorization Bypass
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/<name> scope on the account's raw super-admin ACL flag (access.api.super) instead of validating the presented API key's actual scope. An attacker holding an API key scoped only to api.media.write minted on a super-admin account can bypass the authorization check and, via POST /blueprint-upload or GET /blueprint-files, write a file into another user's scope (in the shared user/accounts/ directory, constrained to image extensions by assertSafeExtension()) and browse that scope's file listing, despite the key not being granted api.users.write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.15 - Compensating control
Ensure the API key used for blueprint-upload/blueprint-files cannot access other users’ scopes (e.g., restrict API key usage/permissions so keys scoped to api.media.write cannot reach any endpoints that allow resolving another user’s scope).
- Operational
Rotate any API keys that may have been used to exploit the authorization bypass before deploying the fixed Grav API plugin version 1.0.15.
Event History
Frequently Asked Questions
Which API keys can be used to trigger the authorization bypass?
Exposure requires an API key issued under a super-admin account, even if that key is scoped only to api.media.write. A key from a non-super-admin account is not described as bypassing this check.
What actions can an attacker perform with an affected key?
The vulnerable authorization path can be reached through POST /blueprint-upload to write a file into another user's scope and through GET /blueprint-files to list files in that scope. Uploaded files are limited to image extensions by the safe-extension check.
What is the recommended mitigation if the plugin is vulnerable?
Upgrade the Grav API Plugin to version 1.0.15 or later. If upgrading is not immediately possible, the provided information supports limiting or revoking api.media.write keys issued under super-admin accounts.