# CVE-2026-65895: Grav API Plugin broken access control in ConfigController

Source: https://junglewise.ai/threats/cve-2026-65895-grav-api-plugin-broken-access-control-in-configcontroller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65895 · Severity: high · CVSS 8.5 · Published 2026-07-23

The Grav API Plugin, which provides programmatic access to the Grav CMS, contains a security flaw that allows users with limited administrative permissions to modify critical security settings. An attacker with these permissions could disable site-wide rate limiting or change security policies (CORS) to allow malicious websites to interact with the API. This could lead to large-scale brute-force attacks against user passwords or unauthorized access to sensitive data.

Technologies: [Grav API Plugin](https://junglewise.ai/threats/technologies/api-plugin). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-65895 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65895 being exploited in the wild.

**How severe is CVE-2026-65895?** High severity, with a CVSS score of 8.5, published 23 July 2026.

**Which products and versions are affected?** Grav API Plugin < 1.0.10.

**Is there a fix for CVE-2026-65895?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65895 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65895?** Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in the ConfigController of the Grav API Plugin. The component fails to include the 'plugins/api' scope within its 'SUPER_WRITE_SCOPES' or 'PRIVILEGED_SCOPES' constants, which are intended to gate security-sensitive configurations. Consequently, an authenticated user possessing only the 'api.config.write' permission (rather than 'api.super') can issue PATCH requests to /config/plugins/api. This allows an attacker to disable site-wide rate limiting, facilitating brute-force attacks, or modify CORS policies to include attacker-controlled origins with credentials enabled. The issue is resolved in version 1.0.10.

## Affected products

- getgrav Grav API Plugin < 1.0.10

## Timeline

- 2026-07-09: advisory: GitHub Security Advisory published
- 2026-07-23: disclosed: NVD publication date

## References

- [https://github.com/getgrav/grav/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd](https://github.com/getgrav/grav/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd)
- [https://github.com/getgrav/grav/security/advisories/GHSA-4pqv-2qj5-38fp](https://github.com/getgrav/grav/security/advisories/GHSA-4pqv-2qj5-38fp)
- [https://www.vulncheck.com/advisories/grav-api-plugin-before-broken-access-control](https://www.vulncheck.com/advisories/grav-api-plugin-before-broken-access-control)

## Related threats

- [Grav API plugin session validation bypass in disabled accounts](https://junglewise.ai/threats/cve-2026-109320-the-grav-api-plugin-grav-plugin-api-before-1-0-36-contains-an)
- [Grav API Plugin password reset link spoofing via Host header](https://junglewise.ai/threats/cve-2026-86196-grav-api-plugin-password-reset-link-spoofing-via-host-header)
- [Grav API Plugin scope cap bypass in page permissions](https://junglewise.ai/threats/cve-2026-80204-grav-api-plugin-scope-cap-bypass-in-page-permissions)
- [Grav API plugin server-side request forgery in webhook delivery](https://junglewise.ai/threats/cve-2026-56708-grav-api-plugin-server-side-request-forgery-in-webhook-delivery)
- [Grav API Plugin privilege escalation in API key management](https://junglewise.ai/threats/cve-2026-64852-grav-api-plugin-privilege-escalation-in-api-key-management)