Authorization Bypass in Grav API Plugin by Grav

CVE-2026-75836

What is CVE-2026-75836?

The Grav API plugin prior to version 1.0.14 contains a significant vulnerability where the authorization requirement is not properly enforced in the MenubarController::executeAction() method. While the GET /menubar/items endpoint appropriately filters based on user permissions, the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only verifies the basic api.access permission. This oversight allows any authenticated user with api.access permissions to execute privileged actions directly, circumventing the intended authorization mechanism. Although there are currently no core plugins utilizing this vulnerability, any first- or third-party plugin depending on the expected authorization process is potentially at risk.

References