CVE-2026-75836: Grav API Plugin before 1.0.14 Missing Authorization
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize(), the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only checks the baseline api.access permission and never evaluates the authorize field a plugin registered for that action. Any authenticated caller with api.access can therefore invoke a privileged menubar action directly, bypassing the intended authorization. No plugin bundled with core Grav currently registers a privileged authorize handler, so on a stock install the impact is latent; the flaw affects any first- or third-party plugin relying on the documented authorize semantics.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.14
Event History
Frequently Asked Questions
Which deployments are realistically affected?
Exposure requires the Grav API plugin to be used with a first- or third-party plugin that registers a menubar action and relies on its authorize field for access control. No core Grav bundled plugin currently registers a privileged authorize handler, so the impact is latent on a stock installation.
What access does an attacker need to exploit this?
An attacker needs to be authenticated and have the baseline api.access permission. They can then send a POST request to /api/v1/menubar/actions/{plugin}/{action} for a registered action without satisfying that action's intended authorize requirement.
What can be done if patching is delayed?
Update the Grav API plugin to version 1.0.14 or later. If updating is not immediately possible, remove api.access from users who do not require it and avoid or disable plugins whose menubar actions depend on authorize semantics.
How can I determine whether my deployment is affected?
Review installed first- and third-party plugins for menubar actions that register an authorize field, then determine whether users with api.access can invoke those actions through the POST menubar-actions endpoint. The GET /menubar/items endpoint filtering is not sufficient evidence that the corresponding action endpoint is protected.