Authorization Bypass in Grav API Plugin Affects Grav by Getgrav

CVE-2026-75832

What is CVE-2026-75832?

The Grav API plugin, bundled with Grav 2.0, prior to version 1.0.14, is susceptible to a missing authorization vulnerability. This flaw arises in the BlueprintPathResolver::resolveUserScope() method, which fails to properly validate the scope of the API key presented. An attacker possessing an API key restricted to 'api.media.write' from a super-admin account can bypass necessary authorization checks. This allows them to upload files to another user's scope within the shared user/accounts/ directory and to list files in that scope, despite lacking permissions for 'api.users.write'. Upgrading to version 1.0.15 or higher is recommended to mitigate this risk.

References