by Kastro
Paper/Archive/CVE-2026-75835

CVE-2026-75835

getgrav grav — Grav API Plugin before 1.0.14 Missing Authorization

EPSS 0.3%public exploitCVSS 9.3
critical.is priorityof 100
43
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 23.6.236 × 204.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a result, an authenticated attacker holding a scoped API key minted on a privileged account can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions (sidebar/menubar/widget items and users-list columns/row-actions/filter-tabs) that their key scope should deny, resulting in information disclosure.

Affected

ProductAffectedFixed inSource
grav< 1.0.141.0.14CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

exploitgithub.com/getgrav/grav/security/advisories/GHSA-p57v-xhv3-mf2wwriteupvulncheck.com/advisories/grav-api-plugin-before-missing-authorization