CVE-2026-80204: Grav before 1.0.18 Authentication Bypass via Scoped API Key
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin()/hasPermission() checks without a request parameter, it cannot enforce scopeAllows(). A caller holding a scoped API key may therefore see (and potentially edit) page permission fields beyond the scope granted to the key. The end-to-end write-time impact was not fully confirmed by the reporter.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using the Grav API plugin before 1.0.18 are affected where scoped API keys are issued to callers that can access the relevant BlueprintController functionality. The issue concerns page security and permissions blueprint sections.
What does an attacker need to exploit it?
An attacker needs a valid scoped API key with sufficient access to reach the affected functionality. No user interaction is required, but the provided data does not confirm that unauthorized changes can be successfully written.
Are installations using only unrestricted administrator access affected in the same way?
The issue is specifically a failure to enforce scope limits on scoped API keys. The supplied information does not indicate an impact on access using unrestricted administrator credentials.
How can I assess whether I may be affected?
Check whether the installed getgrav/grav-plugin-api version is earlier than 1.0.18 and whether scoped API keys are in use. Review whether those keys can view page security or permissions blueprint fields beyond their intended scope.
What can be done if an update cannot be applied immediately?
Limit or revoke scoped API keys that can access the affected page-management functionality, especially keys assigned narrower intended permissions. Monitor use of those keys and review page permission fields for unexpected exposure or changes.