Vulnerability Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.
Related Weaknesses (CWE)
References
- https://github.com/getgrav/grav-plugin-api/commit/ed16f0aaa9b398c6f179fb8f51e0fa
- https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.8
- https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3
- https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3
FAQ
What is CVE-2026-64852?
CVE-2026-64852 is a documented vulnerability. Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks ...
How severe is CVE-2026-64852?
CVSS scoring is not yet available for CVE-2026-64852. Check NVD for updates.
Is there a patch for CVE-2026-64852?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.