# CVE-2026-75832: Grav API plugin authorization bypass in BlueprintPathResolver

Source: https://junglewise.ai/threats/cve-2026-75832-grav-api-plugin-authorization-bypass-in-blueprintpathresolver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75832 · Severity: medium · CVSS 4.3 · Published 2026-08-18

Grav is a flat-file CMS used to power websites without a traditional database. The bundled API plugin allows administrators to issue scoped API keys for integrations—for example, a key restricted to image uploads only. A flaw in how the plugin checks authorization permissions allows an attacker with a narrowly-scoped API key (intended only for media uploads) to access and modify files in other users' account directories, if that key was issued by a super-admin account. This could lead to unauthorized data access or account compromise.

Technologies: [Grav API Plugin](https://junglewise.ai/threats/technologies/api-plugin). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-75832 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75832 being exploited in the wild.

**How severe is CVE-2026-75832?** Medium severity, with a CVSS score of 4.3, published 18 August 2026.

**Which products and versions are affected?** Grav API Plugin before 1.0.15 (fixed in 1.0.15).

**Is there a fix for CVE-2026-75832?** A patch was published on 2026-08-18: Version 1.0.15 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75832 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75832?** Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check in BlueprintPathResolver::resolveUserScope() (CWE-862). The method validates access to the users/<name> scope by checking if the caller is a super-admin, but it reads the raw account-level ACL flag (access.api.super) instead of validating the presented API key's actual scopes. An API key scoped to ["api.access", "api.media.write"] minted on a super-admin account bypasses the authorization gate and can call POST /blueprint-upload or GET /blueprint-files to write files into or list files from another user's scope (user/accounts/ directory, images only due to assertSafeExtension()). The root cause is architectural: BlueprintPathResolver is a service class that never receives the HTTP request or its key scopes, making it unable to consult the scope-aware authorization helpers already used elsewhere in the codebase. Patches are available in version 1.0.15, which passes the caller's actual scope-aware super status to the resolver methods.

## Affected products

- Grav API plugin before 1.0.15 (fixed in 1.0.15)

## Timeline

- 2026-08-03: advisory: GitHub Security Advisory GHSA-435x-66r2-jwv2 published
- 2026-08-18: disclosed: CVE-2026-75832 published on NVD
- 2026-08-18: patched: Version 1.0.15 released with fix

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-435x-66r2-jwv2](https://github.com/getgrav/grav/security/advisories/GHSA-435x-66r2-jwv2)
- [https://www.vulncheck.com/advisories/grav-api-plugin-before-authorization-bypass](https://www.vulncheck.com/advisories/grav-api-plugin-before-authorization-bypass)

## Related threats

- [Grav API plugin session validation bypass in disabled accounts](https://junglewise.ai/threats/cve-2026-109320-the-grav-api-plugin-grav-plugin-api-before-1-0-36-contains-an)
- [Grav API Plugin password reset link spoofing via Host header](https://junglewise.ai/threats/cve-2026-86196-grav-api-plugin-password-reset-link-spoofing-via-host-header)
- [Grav API Plugin scope cap bypass in page permissions](https://junglewise.ai/threats/cve-2026-80204-grav-api-plugin-scope-cap-bypass-in-page-permissions)
- [Grav API plugin server-side request forgery in webhook delivery](https://junglewise.ai/threats/cve-2026-56708-grav-api-plugin-server-side-request-forgery-in-webhook-delivery)
- [Grav API Plugin privilege escalation in API key management](https://junglewise.ai/threats/cve-2026-64852-grav-api-plugin-privilege-escalation-in-api-key-management)