Security Flaw in Grav API Plugin for Grav CMS

CVE-2026-62667

What is CVE-2026-62667?

The Grav API Plugin, a RESTful API for the Grav CMS, has a vulnerability that allows for unauthorized access to sensitive operations. In versions prior to 1.0.6, the ApiKeyManager::generateKey() method stores a declared scopes array, yet the subsequent ApiKeyAuthenticator::authenticate() function fails to read keyData[scopes]. As a result, it exposes the complete identity of the owning user. The AbstractApiController::requirePermission() method evaluates the full user Access Control List (ACL), enabling a key issued for read-only access to execute any write, delete, or administrative operations pertaining to the owner. This serious oversight compromises the integrity of user permissions, effectively allowing unauthorized actions on the platform until the issue is resolved in version 1.0.6.

References