Is CVE-2026-62231 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62231 being exploited in the wild.

How severe is CVE-2026-62231?

High severity, with a CVSS score of 8.1, published 17 July 2026.

Is there a fix for CVE-2026-62231?

A patch was published on 2026-07-17: Fix released in version 1.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62231 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-62231?

Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62231: Grav API plugin authorization bypass in ApiKeyAuthenticator

CVE-2026-62231 · Severity: high · CVSS 8.1 · Published 2026-07-17

The Grav API plugin, which allows external applications to interact with the Grav content management system, contains a flaw in how it handles security permissions for API keys. While administrators can create keys intended for limited tasks (such as read-only access), the system fails to enforce these restrictions, granting the key the full administrative power of the account that created it. This could allow a person or automated script with a restricted key to perform unauthorized actions, such as deleting content or modifying system settings.

Technologies: Grav API Plugin. Vendors: Grav.

Quick answers

Is CVE-2026-62231 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62231 being exploited in the wild.
How severe is CVE-2026-62231?: High severity, with a CVSS score of 8.1, published 17 July 2026.
Which products and versions are affected?: Grav API Plugin < 1.0.6.
Is there a fix for CVE-2026-62231?: A patch was published on 2026-07-17: Fix released in version 1.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62231 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-62231?: Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in the Grav API plugin (getgrav/grav-plugin-api) due to the 'scopes' array being ignored during the authentication process. While the ApiKeyManager allows for the creation and storage of scoped keys (e.g., 'api.pages.read'), the ApiKeyAuthenticator class only validates the key's existence and expiry before returning the full UserInterface object of the owner. Consequently, the requirePermission() check in the AbstractApiController evaluates the user's full Access Control List (ACL) rather than the restricted scopes of the API key. An attacker with a low-privileged API key can perform write, delete, or administrative operations if the owning account has those permissions. This issue is fixed in version 1.0.6.

Affected products

getgrav Grav API plugin (getgrav/grav-plugin-api) < 1.0.6

Timeline

2026-06-29: advisory: Vendor advisory published on GitHub
2026-07-17: disclosed: NVD publication date
2026-07-17: patched: Fix released in version 1.0.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.