API Key Authorization Flaw in Grav Plugin Allows Unauthorized Access
CVE-2026-65007

8.7HIGH

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
21 July 2026

What is CVE-2026-65007?

The Grav API plugin prior to version 1.0.8 contains a significant vulnerability that fails to correctly authorize the generation and revocation of API keys. This flaw allows any user with basic admin privileges to generate persistent API keys associated with any user account. As a result, it not only permits the creation of unauthorized access paths but also allows for account impersonation and potential privilege escalation. If an account with elevated permissions is accessible through this exploit, it could lead to a complete account takeover, severely compromising the security of the affected installations.

Affected Version(s)

grav 0 < 1.0.8

grav 1.0.8

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/grav-before-missing-...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

YuvalMil
LeonKaya
.