Is CVE-2026-80203 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80203 being exploited in the wild.

How severe is CVE-2026-80203?

Critical severity, with a CVSS score of 9.8, published 26 August 2026.

Which products and versions are affected?

Grav grav-plugin-api before 1.0.18.

Is there a fix for CVE-2026-80203?

A patch was published on 2026-08-26: Version 1.0.18 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-80203 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-80203?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80203: Grav API Plugin authorization bypass in user management

CVE-2026-80203 · Severity: critical · CVSS 9.8 · Published 2026-08-26

The Grav API plugin incorrectly validates permissions for sensitive user-management operations, allowing a scoped API key belonging to an administrator to act against other administrators' accounts. An attacker with such a key can disable two-factor authentication, delete avatars, create new API keys, or delete existing keys on other admin accounts, effectively gaining unauthorized control without needing full administrator privileges.

Quick answers

Is CVE-2026-80203 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80203 being exploited in the wild.
How severe is CVE-2026-80203?: Critical severity, with a CVSS score of 9.8, published 26 August 2026.
Which products and versions are affected?: Grav grav-plugin-api before 1.0.18.
Is there a fix for CVE-2026-80203?: A patch was published on 2026-08-26: Version 1.0.18 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80203 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-80203?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incorrect authorization check (CWE-863) in the requireNotSuperTarget() function within UsersController.php. The function checks whether the current user account is a super-admin (isSuperAdmin()) rather than verifying whether the specific API key carries super authority (isSuperWithinScope()). This allows a scoped API key—restricted to less than full super authority—belonging to a super-admin account to bypass the scope cap across seven sensitive endpoints: rowAction(), uploadAvatar(), deleteAvatar(), generate2fa(), disable2fa(), createApiKey(), and deleteApiKey(). The fix requires passing the $request parameter (available at all call sites) to requireNotSuperTarget() and replacing isSuperAdmin() with isSuperWithinScope(), aligning with the codebase's documented authorization pattern and mirroring fixes applied to prior vulnerabilities (GHSA-p57v-xhv3-mf2w and GHSA-435x-66r2-jwv2).

Affected products

Grav grav-plugin-api before 1.0.18

Timeline

2026-08-11: disclosed: GitHub Security Advisory GHSA-94q7-vrqr-cx5v published
2026-08-26: advisory: CVE-2026-80203 published on NVD
2026-08-26: patched: Version 1.0.18 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.