Is CVE-2026-65007 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65007 being exploited in the wild.

How severe is CVE-2026-65007?

Critical severity, with a CVSS score of 9.6, published 21 July 2026.

Is there a fix for CVE-2026-65007?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-65007 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65007?

Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65007: Grav api plugin missing authorization in API key generation

CVE-2026-65007 · Severity: critical · CVSS 9.6 · Published 2026-07-21

A vulnerability in the Grav API plugin allows any user with basic login access to the administration panel to generate API keys for any other account, including administrators. This flaw enables a low-privileged user to impersonate high-privileged accounts and gain full control over the website's data and configuration. Organizations using this plugin should update immediately to prevent unauthorized account takeovers.

Technologies: Grav API Plugin. Vendors: Grav.

Quick answers

Is CVE-2026-65007 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65007 being exploited in the wild.
How severe is CVE-2026-65007?: Critical severity, with a CVSS score of 9.6, published 21 July 2026.
Which products and versions are affected?: Grav API Plugin < 1.0.8.
Is there a fix for CVE-2026-65007?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-65007 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65007?: Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Grav api plugin (grav-plugin-api) before version 1.0.8 contains a missing authorization check in its handling of admin tasks. The plugin intercepts 'apiKeyGenerate' and 'apiKeyRevoke' tasks before the standard Grav account-management Access Control List (ACL) is applied. It incorrectly validates the requester using only the 'admin.login' permission, which is the baseline permission for all panel users. An authenticated attacker can exploit this by sending a crafted request to mint a persistent API key bound to a target account. This forged key inherits the target's API permissions, potentially leading to full account takeover if the target has elevated privileges such as 'api.super'. The issue is resolved in version 1.0.8.

Affected products

getgrav grav-plugin-api < 1.0.8

Timeline

2026-07-07: advisory: Initial GHSA advisory published
2026-07-21: disclosed: CVE-2026-65007 published and added to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.