CVE-2026-62667— Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| getgrav | grav-plugin-api | < 1.0.6 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-62667
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL
Source: CVE Program / CVE List V5
Vulnerability Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the owning user's complete identity. AbstractApiController::requirePermission() consequently evaluates the full user ACL, so a key issued for a read-only scope can perform every write, delete, and administrative operation available to the owner. This issue is fixed in version 1.0.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Grav API Plugin 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Grav API Plugin是Grav组织的一款提供API接口功能的插件。 Grav API Plugin 1.0.6之前版本存在授权问题漏洞，该漏洞源于API密钥认证时未正确读取声明的scopes数组，返回拥有用户的完整身份，导致权限检查评估完整用户ACL，只读范围的密钥可执行所有写入、删除和管理操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| getgrav | grav-plugin-api | < 1.0.6 | - |
II. Public POCs for CVE-2026-62667
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCVerified env Premium
Qwen3.6-35B-A3B · 9943 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-62667
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-62667 (1)
Vendor Advisories for CVE-2026-62667 (1)
Vendor Pages for CVE-2026-62667 (1)
- 🔗 Release 1.0.6 · getgrav/grav-plugin-api · GitHubx_refsource_MISC
Same Patch Batch · getgrav · 2026-08-19 · 17 CVEs total
| CVE-2026-62668 | 9.4 CRITICAL | Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols |
| CVE-2026-62666 | 8.8 HIGH | Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomp |
| CVE-2026-64850 | 8.7 HIGH | Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() |
| CVE-2026-64852 | 8.7 HIGH | Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login use |
| CVE-2026-64851 | 8.5 HIGH | Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers |
| CVE-2026-62673 | 8.2 HIGH | Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesys |
| CVE-2026-63407 | 8.2 HIGH | Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses |
| CVE-2026-63408 | 7.5 HIGH | Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter |
| CVE-2026-62669 | 7.4 HIGH | Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pen |
| CVE-2026-61690 | 6.5 MEDIUM | Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits |
| CVE-2026-61842 | 6.5 MEDIUM | Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 by |
| CVE-2026-62670 | 6.3 MEDIUM | Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets f |
| CVE-2026-62672 | 6.0 MEDIUM | Grav: Authenticated ReDoS via regex_replace in Twig Sandbox |
| CVE-2026-62671 | 5.4 MEDIUM | CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret |
| CVE-2026-53654 | 5.3 MEDIUM | Grav: Unauthenticated open redirect via login twofa_cancel _redirect |
| CVE-2026-61607 | 4.6 MEDIUM | Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer |
IV. Related Vulnerabilities
Same product: grav-plugin-api
- CVE-2026-64852
Grav API Plugin: Missing authorization on API-key generate/r - CVE-2026-63408
Grav API Plugin: JWT Access Token Accepted via `?token=` URL - CVE-2026-63407
Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Au - CVE-2026-62666
Grav API Plugin: non-super api.users.write manager -> super- - CVE-2026-61607
Grav API Plugin: Stored XSS via SVG Upload - API Media Pipel
Same vendor: getgrav
- CVE-2026-64852
Grav API Plugin: Missing authorization on API-key generate/r - CVE-2026-64850
Grav: Remote code execution via unrestricted callable in Blu - CVE-2026-64851
Grav Shortcode Core Plugin: Stored XSS in shortcode-core att - CVE-2026-63408
Grav API Plugin: JWT Access Token Accepted via `?token=` URL - CVE-2026-63407
Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Au
Same weakness: CWE-862
- CVE-2026-34836
Combodo iTop: Improper access control in ajax.render.php and - CVE-2026-53487
Kite has an authenticated cluster RBAC bypass in /api/v1/ove - CVE-2026-33047
Combodo iTop: Object can be locked by a user without write p - CVE-2026-31936
Combodo iTop: Unauthorized access to object information via - CVE-2026-76876
Craftplan < 0.5.1 Broken Access Control Information Disclosu
V. Comments for CVE-2026-62667
No comments yet