Is CVE-2026-75832 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75832 being exploited in the wild.

How severe is CVE-2026-75832?

Medium severity, with a CVSS score of 4.3, published 18 August 2026.

Which products and versions are affected?

Grav API Plugin before 1.0.15 (fixed in 1.0.15).

Is there a fix for CVE-2026-75832?

A patch was published on 2026-08-18: Version 1.0.15 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75832 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-75832?

Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75832: Grav API plugin authorization bypass in BlueprintPathResolver

CVE-2026-75832 · Severity: medium · CVSS 4.3 · Published 2026-08-18

Grav is a flat-file CMS used to power websites without a traditional database. The bundled API plugin allows administrators to issue scoped API keys for integrations—for example, a key restricted to image uploads only. A flaw in how the plugin checks authorization permissions allows an attacker with a narrowly-scoped API key (intended only for media uploads) to access and modify files in other users' account directories, if that key was issued by a super-admin account. This could lead to unauthorized data access or account compromise.

Technologies: Grav API Plugin. Vendors: Grav.

Quick answers

Is CVE-2026-75832 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75832 being exploited in the wild.
How severe is CVE-2026-75832?: Medium severity, with a CVSS score of 4.3, published 18 August 2026.
Which products and versions are affected?: Grav API Plugin before 1.0.15 (fixed in 1.0.15).
Is there a fix for CVE-2026-75832?: A patch was published on 2026-08-18: Version 1.0.15 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75832 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-75832?: Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check in BlueprintPathResolver::resolveUserScope() (CWE-862). The method validates access to the users/<name> scope by checking if the caller is a super-admin, but it reads the raw account-level ACL flag (access.api.super) instead of validating the presented API key's actual scopes. An API key scoped to ["api.access", "api.media.write"] minted on a super-admin account bypasses the authorization gate and can call POST /blueprint-upload or GET /blueprint-files to write files into or list files from another user's scope (user/accounts/ directory, images only due to assertSafeExtension()). The root cause is architectural: BlueprintPathResolver is a service class that never receives the HTTP request or its key scopes, making it unable to consult the scope-aware authorization helpers already used elsewhere in the codebase. Patches are available in version 1.0.15, which passes the caller's actual scope-aware super status to the resolver methods.

Affected products

Grav API plugin before 1.0.15 (fixed in 1.0.15)

Timeline

2026-08-03: advisory: GitHub Security Advisory GHSA-435x-66r2-jwv2 published
2026-08-18: disclosed: CVE-2026-75832 published on NVD
2026-08-18: patched: Version 1.0.15 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.