Executive brief
Grav is a flat-file CMS used to power websites without a traditional database. The bundled API plugin allows administrators to issue scoped API keys for integrations—for example, a key restricted to image uploads only. A flaw in how the plugin checks authorization permissions allows an attacker with a narrowly-scoped API key (intended only for media uploads) to access and modify files in other users' account directories, if that key was issued by a super-admin account. This could lead to unauthorized data access or account compromise.
Technical details
The vulnerability is a missing authorization check in BlueprintPathResolver::resolveUserScope() (CWE-862). The method validates access to the users/<name> scope by checking if the caller is a super-admin, but it reads the raw account-level ACL flag (access.api.super) instead of validating the presented API key's actual scopes. An API key scoped to ["api.access", "api.media.write"] minted on a super-admin account bypasses the authorization gate and can call POST /blueprint-upload or GET /blueprint-files to write files into or list files from another user's scope (user/accounts/ directory, images only due to assertSafeExtension()). The root cause is architectural: BlueprintPathResolver is a service class that never receives the HTTP request or its key scopes, making it unable to consult the scope-aware authorization helpers already used elsewhere in the codebase. Patches are available in version 1.0.15, which passes the caller's actual scope-aware super status to the resolver methods.
Affected products
- Grav API plugin before 1.0.15 (fixed in 1.0.15)
Timeline
- 2026-08-03: advisory: GitHub Security Advisory GHSA-435x-66r2-jwv2 published
- 2026-08-18: disclosed: CVE-2026-75832 published on NVD
- 2026-08-18: patched: Version 1.0.15 released with fix