Is CVE-2026-75835 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75835 being exploited in the wild.

How severe is CVE-2026-75835?

Medium severity, with a CVSS score of 4.3, published 18 August 2026.

Which products and versions are affected?

Getgrav Grav-Plugin-Api before 1.0.14.

Is there a fix for CVE-2026-75835?

A patch was published on 2026-08-18: Version 1.0.14 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75835 attacked?

It is attacked over the network.

Am I affected by CVE-2026-75835?

Check whether you run Getgrav Grav-Plugin-Api at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75835: Grav API plugin missing authorization in scope validation

CVE-2026-75835 · Severity: medium · CVSS 4.3 · Published 2026-08-18

Grav's API plugin is used to manage content and administrative functions via authenticated API keys. This vulnerability allows an attacker with a restricted API key (issued on a privileged account) to bypass scope restrictions and view UI metadata, item definitions, and configuration details they should not have access to. While read-only, this information disclosure could expose sensitive operational details and aid further attacks.

Technologies: Getgrav Grav-Plugin-Api. Vendors: Getgrav.

Quick answers

Is CVE-2026-75835 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75835 being exploited in the wild.
How severe is CVE-2026-75835?: Medium severity, with a CVSS score of 4.3, published 18 August 2026.
Which products and versions are affected?: Getgrav Grav-Plugin-Api before 1.0.14.
Is there a fix for CVE-2026-75835?: A patch was published on 2026-08-18: Version 1.0.14 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75835 attacked?: It is attacked over the network.
Am I affected by CVE-2026-75835?: Check whether you run Getgrav Grav-Plugin-Api at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The userPassesAuthorize() function in AbstractApiController.php fails to validate API key scopes when determining authorization for gated UI items. It checks the underlying user account's raw super-admin flag and ACL permissions without consulting the calling request's declared api_key_scopes. An attacker with a scoped API key (e.g., restricted to ["api.access", "api.pages.read"]) minted on a super-admin account can bypass scope restrictions to access authorize-gated sidebar/menubar/widget items and users-list metadata that the key's declared scope should deny. The vulnerability affects six call sites across multiple controllers (SidebarController, FloatingWidgetController, EditorButtonsController, MenubarController, UsersController). Exploitation requires a valid API key and is read-only; patches are available in version 1.0.14.

Affected products

getgrav grav-plugin-api before 1.0.14

Timeline

2026-08-18: disclosed
2026-08-18: patched: Version 1.0.14 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.