Executive brief
The Grav API plugin's menubar action endpoint fails to enforce the permission controls that plugins declare for their actions. An authenticated user with basic API access can invoke privileged actions directly via POST endpoint, bypassing authorization checks that would normally block them. While no actions in the standard installation are exploitable this way, any plugin relying on the documented authorization model is vulnerable to privilege escalation.
Technical details
The MenubarController::executeAction() endpoint (POST /api/v1/menubar/actions/{plugin}/{action}) implements a missing authorization vulnerability (CWE-862). While the GET /menubar/items endpoint correctly filters items using the userPassesAuthorize() check against each plugin's declared authorize permission, the POST action endpoint only verifies baseline api.access permission and ignores the authorize field. An authenticated attacker with api.access can call POST directly to bypass the intended authorization model. The fix requires querying the menubar items event, locating the matching plugin/action pair, and calling userPassesAuthorize() against its authorize value before firing the action event. Patch available in version 1.0.14.
Affected products
- GetGrav API Plugin before 1.0.14
Timeline
- 2026-08-03: disclosed: GitHub Security Advisory GHSA-8mjx-xjfv-9c88 published
- 2026-08-18: advisory: CVE-2026-75836 assigned
- 2026-08: patched: Fixed in API plugin version 1.0.14