Authorization Bypass in Grav API Plugin by Grav

CVE-2026-62231

What is CVE-2026-62231?

The Grav API plugin before version 1.0.6 features an authorization bypass vulnerability within its ApiKeyAuthenticator class. Although API keys can be generated with restricted scopes, the class does not enforce these limitations. This flaw allows API keys with limited permissions (such as read-only access) to execute any operation authorized for the owning user, including write, delete, or administrative actions. Users are encouraged to upgrade to version 1.0.6 or later, where this issue has been resolved.

References