# CVE-2026-80204: Grav API Plugin scope cap bypass in page permissions

Source: https://junglewise.ai/threats/cve-2026-80204-grav-api-plugin-scope-cap-bypass-in-page-permissions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80204 · Severity: medium · CVSS 5.4 · Published 2026-08-26

The Grav API plugin is a component that allows programmatic access to Grav CMS content via API keys with restricted permissions ("scoped keys"). A flaw in the injectSecurityTab() function fails to enforce these permission restrictions when displaying or allowing edits to page security settings, allowing someone with a limited API key to view and potentially modify permissions beyond what their key should grant. This defeats the purpose of using restricted API keys and exposes sensitive access control settings.

Technologies: [Grav API Plugin](https://junglewise.ai/threats/technologies/api-plugin). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-80204 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80204 being exploited in the wild.

**How severe is CVE-2026-80204?** Medium severity, with a CVSS score of 5.4, published 26 August 2026.

**Which products and versions are affected?** Grav API Plugin before 1.0.18.

**Is there a fix for CVE-2026-80204?** A patch was published on 2026-08-26: version 1.0.18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-80204 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-80204?** Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (CWE-863) in the injectSecurityTab() function of BlueprintController within the Grav API plugin. The function uses raw isSuperAdmin() and hasPermission() checks without a request parameter, preventing it from enforcing the scopeAllows() scope cap that is consistently applied elsewhere in the codebase. An attacker holding a scoped API key can request the page blueprint, which will incorrectly expose and permit editing of security/permissions fields beyond the scope granted to the key. The reporter confirmed the information disclosure aspect (revealing full account permissions rather than scoped key limits) but noted that end-to-end write impact depends on whether the blueprint field presence gates write-time enforcement, which was not fully traced. The fix is to thread the request object into injectSecurityTab() to enable proper scope enforcement, matching the established pattern used in hasPermissionWithinScope().

## Affected products

- Grav API plugin before 1.0.18

## Timeline

- 2026-08-26: disclosed
- 2026-08-26: patched: version 1.0.18

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-mcx6-4rvg-7r8v](https://github.com/getgrav/grav/security/advisories/GHSA-mcx6-4rvg-7r8v)
- [https://www.vulncheck.com/advisories/grav-before-1.0.18-authentication-bypass-via-scoped-api-key-2](https://www.vulncheck.com/advisories/grav-before-1.0.18-authentication-bypass-via-scoped-api-key-2)

## Related threats

- [Grav API plugin session validation bypass in disabled accounts](https://junglewise.ai/threats/cve-2026-109320-the-grav-api-plugin-grav-plugin-api-before-1-0-36-contains-an)
- [Grav API Plugin password reset link spoofing via Host header](https://junglewise.ai/threats/cve-2026-86196-grav-api-plugin-password-reset-link-spoofing-via-host-header)
- [Grav API plugin server-side request forgery in webhook delivery](https://junglewise.ai/threats/cve-2026-56708-grav-api-plugin-server-side-request-forgery-in-webhook-delivery)
- [Grav API Plugin privilege escalation in API key management](https://junglewise.ai/threats/cve-2026-64852-grav-api-plugin-privilege-escalation-in-api-key-management)
- [Grav API Plugin JWT token exposure in URL query parameter](https://junglewise.ai/threats/cve-2026-63408-grav-api-plugin-jwt-token-exposure-in-url-query-parameter)