High severity · published Aug 19, 2026
CVE-2026-64852
Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav-plugin-api · getgrav
< 1.0.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64852
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-64852
github.com
https://github.com/getgrav/grav-plugin-api/commit/ed16f0aaa9b398c6f179fb8f51e0fa53e4ed8a30
github.com
https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.8
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3
More from grav-plugin-api
9.8
CVE-2026-112779
Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
9.4
CVE-2026-62668
Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols
8.8
CVE-2026-62666
Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super
8.8
CVE-2026-72833
Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys
8.8
CVE-2026-42843
grav-plugin-api: Grav API Privilege Escalation to Super Admin