Missing Authorization in Grav API Plugin Exposes User Data
CVE-2026-75835

9.3CRITICAL

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
18 August 2026

What is CVE-2026-75835?

The Grav API Plugin before version 1.0.14 contains a significant authorization flaw in the userPassesAuthorize() function. This vulnerability allows authenticated attackers with scoped API keys to sidestep their defined scope restrictions by leveraging a super-admin flag and existing ACL grants. Consequently, such attackers may gain unauthorized access to sensitive UI metadata and other resources that should be restricted, resulting in potential information disclosure. It's crucial for users to upgrade to the latest version to mitigate this risk.

Affected Version(s)

grav 0 < 1.0.14

grav 1.0.14

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/grav-api-plugin-befo...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

iaohkut-from-NightWolf-Team
.