CVE-2026-75835: Grav API Plugin before 1.0.14 Missing Authorization
Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a result, an authenticated attacker holding a scoped API key minted on a privileged account can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions (sidebar/menubar/widget items and users-list columns/row-actions/filter-tabs) that their key scope should deny, resulting in information disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.14
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
The exposed population is deployments that use the Grav API plugin before 1.0.14 and issue scoped API keys from accounts with super-admin status or relevant ACL grants. The issue is reachable remotely by an authenticated attacker and does not require user interaction.
What credentials are required to exploit this?
An attacker needs a valid scoped API key that was minted on a privileged account. The key's declared scopes must deny access to the targeted authorize-gated UI metadata or item definitions, while the underlying account's super-admin flag or ACL grants permit it.
What can an attacker access after bypassing scope restrictions?
The attacker can disclose authorize-gated UI metadata and item definitions, including sidebar, menubar, and widget items, as well as users-list columns, row actions, and filter tabs. The provided data describes information disclosure only; it does not indicate integrity or availability impact.