Executive brief
A vulnerability in the Grav API plugin allows any user with basic login access to the administration panel to generate API keys for any other account, including administrators. This flaw enables a low-privileged user to impersonate high-privileged accounts and gain full control over the website's data and configuration. Organizations using this plugin should update immediately to prevent unauthorized account takeovers.
Technical details
The Grav api plugin (grav-plugin-api) before version 1.0.8 contains a missing authorization check in its handling of admin tasks. The plugin intercepts 'apiKeyGenerate' and 'apiKeyRevoke' tasks before the standard Grav account-management Access Control List (ACL) is applied. It incorrectly validates the requester using only the 'admin.login' permission, which is the baseline permission for all panel users. An authenticated attacker can exploit this by sending a crafted request to mint a persistent API key bound to a target account. This forged key inherits the target's API permissions, potentially leading to full account takeover if the target has elevated privileges such as 'api.super'. The issue is resolved in version 1.0.8.
Affected products
- getgrav grav-plugin-api < 1.0.8
Timeline
- 2026-07-07: advisory: Initial GHSA advisory published
- 2026-07-21: disclosed: CVE-2026-65007 published and added to NVD