# CVE-2026-62667: Grav API Plugin API key scope bypass

Source: https://junglewise.ai/threats/cve-2026-62667-grav-api-plugin-api-key-scope-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62667 · Severity: high · CVSS 8.1 · Published 2026-08-19

The Grav API Plugin provides headless content access to Grav CMS sites via API keys. Prior to version 1.0.6, the plugin failed to enforce API key scopes during authentication, allowing a "read-only" API key to perform all write, delete, and administrative operations available to its owner account. This enables attackers with a scoped API key to gain full control over the site's content and configuration.

Technologies: [Grav API Plugin](https://junglewise.ai/threats/technologies/api-plugin). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-62667 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62667 being exploited in the wild.

**How severe is CVE-2026-62667?** High severity, with a CVSS score of 8.1, published 19 August 2026.

**Which products and versions are affected?** Grav API Plugin before 1.0.6.

**Is there a fix for CVE-2026-62667?** A patch was published on 2026-06-26: fix released in version 1.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62667 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62667?** Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from a scope enforcement bypass in the API key authentication flow. The ApiKeyManager::generateKey() method stores declared scopes in the key data, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the full owning user's complete identity. AbstractApiController::requirePermission() then evaluates the complete user ACL rather than the key's declared scopes, allowing a read-only key to bypass all authorization checks. No authentication is required beyond possession of a valid API key. The fix in version 1.0.6 ensures scopes are passed through the authentication chain and enforced in the authorization check, capping key privileges even for super-admin-owned keys.

## Affected products

- Grav API Plugin before 1.0.6

## Timeline

- 2026-08-19: disclosed
- 2026-06-26: patched: fix released in version 1.0.6

## References

- [https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e](https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e)
- [https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6](https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6)

## Related threats

- [Grav API plugin session validation bypass in disabled accounts](https://junglewise.ai/threats/cve-2026-109320-the-grav-api-plugin-grav-plugin-api-before-1-0-36-contains-an)
- [Grav API Plugin password reset link spoofing via Host header](https://junglewise.ai/threats/cve-2026-86196-grav-api-plugin-password-reset-link-spoofing-via-host-header)
- [Grav API Plugin scope cap bypass in page permissions](https://junglewise.ai/threats/cve-2026-80204-grav-api-plugin-scope-cap-bypass-in-page-permissions)
- [Grav API plugin server-side request forgery in webhook delivery](https://junglewise.ai/threats/cve-2026-56708-grav-api-plugin-server-side-request-forgery-in-webhook-delivery)
- [Grav API Plugin privilege escalation in API key management](https://junglewise.ai/threats/cve-2026-64852-grav-api-plugin-privilege-escalation-in-api-key-management)