CVE-2026-62666: CWE-639: Authorization Bypass Through User-Controlled Key in getgrav grav-plugin-api
A vulnerability in the Grav API Plugin prior to version 1.0.6 allows a non-super user with api.users.write permission to create an API key with super-administrator privileges. This occurs because certain user mutation endpoints omit a critical access check, enabling unauthorized privilege escalation and manipulation of two-factor authentication settings.
AI Analysis
Technical Summary
The Grav API Plugin for Grav CMS versions before 1.0.6 contains an authorization bypass vulnerability (CVE-2026-62666) in the UsersController methods createApiKey(), generate2fa(), and disable2fa(). These methods fail to perform the accessGrantsSuper() target check that sibling user mutation endpoints enforce. Consequently, a non-super user with api.users.write permission can mint an API key scoped to access.api.super, gaining full super-administrator privileges. This flaw also allows unauthorized rotation or disabling of two-factor authentication for the target account. The vulnerability is due to missing enforcement of key scopes and access checks. The issue is fixed in version 1.0.6.
Potential Impact
An attacker with limited user privileges (api.users.write) can escalate to persistent super-administrator access by creating an API key with super-user scope. This leads to full control over the Grav CMS instance, including the ability to disable or rotate two-factor authentication, significantly compromising confidentiality, integrity, and availability.
Mitigation Recommendations
This vulnerability is fixed in Grav API Plugin version 1.0.6. Users should upgrade to version 1.0.6 or later to remediate this issue. No official patch or temporary fix is indicated beyond upgrading. Until upgraded, restrict api.users.write permissions to trusted users only.
CVE-2026-62666: CWE-639: Authorization Bypass Through User-Controlled Key in getgrav grav-plugin-api
Description
A vulnerability in the Grav API Plugin prior to version 1.0.6 allows a non-super user with api.users.write permission to create an API key with super-administrator privileges. This occurs because certain user mutation endpoints omit a critical access check, enabling unauthorized privilege escalation and manipulation of two-factor authentication settings.
CVSS v3.1
Score 8.8high
Affected software
pkg:github/getgrav/grav-plugin-apiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Grav API Plugin for Grav CMS versions before 1.0.6 contains an authorization bypass vulnerability (CVE-2026-62666) in the UsersController methods createApiKey(), generate2fa(), and disable2fa(). These methods fail to perform the accessGrantsSuper() target check that sibling user mutation endpoints enforce. Consequently, a non-super user with api.users.write permission can mint an API key scoped to access.api.super, gaining full super-administrator privileges. This flaw also allows unauthorized rotation or disabling of two-factor authentication for the target account. The vulnerability is due to missing enforcement of key scopes and access checks. The issue is fixed in version 1.0.6.
Potential Impact
An attacker with limited user privileges (api.users.write) can escalate to persistent super-administrator access by creating an API key with super-user scope. This leads to full control over the Grav CMS instance, including the ability to disable or rotate two-factor authentication, significantly compromising confidentiality, integrity, and availability.
Mitigation Recommendations
This vulnerability is fixed in Grav API Plugin version 1.0.6. Users should upgrade to version 1.0.6 or later to remediate this issue. No official patch or temporary fix is indicated beyond upgrading. Until upgraded, restrict api.users.write permissions to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-14T20:22:04.394Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a85d17aacd9273b4948b46f
Added to database: 08/19/2026, 15:53:30 UTC
Last enriched: 08/19/2026, 16:07:35 UTC
Last updated: 08/19/2026, 21:20:55 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.