CVE-2026-80203— Grav before 1.0.18 Authentication Bypass via Scoped API Key
Quick assessment
Affected
getgrav grav
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
getgrav/grav-plugin-api 插件在 1.0.18 版本之前，在 UsersController.php 的 requireNotSuperTarget() 函数中，未针对七个敏感的用户管理端点强制实施 API 密钥的范围限制。该检查逻辑使用的是当前操作账户的 isSuperAdmin() 方法，而非验证特定 API 密钥是否具备超级管理员权限（通过 isSuperWithinScope() 进行校验）。因此，一个作用范围低于完整超级管理员权限但归属于超级管理员账户的 API 密钥，可能对其他超级
Possible ATT&CK Techniques 2 AI
T1098.005 · Device Registration T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-80203
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Grav before 1.0.18 Authentication Bypass via Scoped API Key
Source: CVE Program / CVE List V5
Vulnerability Description
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-80203
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-80203
请登录查看更多情报信息。
Other References for CVE-2026-80203 (2)
IV. Related Vulnerabilities
Same product: grav
-
CVE-2026-80204
Grav before 1.0.18 Authentication Bypass via Scoped API Key -
CVE-2026-76846
Grav before 2.0.16 Information Disclosure via Twig Sandbox -
CVE-2026-76839
Grav before 2.0.16 Information Disclosure via offsetGet -
CVE-2026-75574
Grav before 4.2.2 Remote Code Execution via Email Twig -
CVE-2026-72702
Grav CMS before 2.0.16 Origin Validation Bypass via Referer
Same vendor: getgrav
-
CVE-2026-80204
Grav before 1.0.18 Authentication Bypass via Scoped API Key -
CVE-2026-76846
Grav before 2.0.16 Information Disclosure via Twig Sandbox -
CVE-2026-76839
Grav before 2.0.16 Information Disclosure via offsetGet -
CVE-2026-75574
Grav before 4.2.2 Remote Code Execution via Email Twig -
CVE-2026-72702
Grav CMS before 2.0.16 Origin Validation Bypass via Referer
Same weakness: CWE-863
-
CVE-2026-77611
SeaweedFS: Authenticated S3 object-scope bypass in PutObject -
CVE-2026-43621
Simple Machines Forum < 2.1.7 Authorization Confusion via Pr -
CVE-2026-77317
SeaweedFS: SFTP path ACL literal prefix match permits cross- -
CVE-2026-77298
SeaweedFS S3 OIDC Bearer authentication bypasses IAM role tr -
CVE-2026-66003
Frappe: Access control bypass via REST API dot-notation fiel
V. Comments for CVE-2026-80203
No comments yet