CVE-2026-75836 is a high-severity vulnerability in the Grav API plugin before version 1.0.14. It involves missing authorization checks in the MenubarController::executeAction() method, allowing authenticated users with basic API access to invoke privileged menubar actions without proper authorization. While the GET menubar items endpoint enforces authorization correctly, the POST endpoint for menubar actions does not evaluate the required authorization field. This flaw currently has latent impact on stock Grav installations as no core plugins register privileged authorize handlers, but it affects any plugins relying on the documented authorization semantics.
CVE-2026-75835 is a critical missing authorization vulnerability in the Grav API plugin (getgrav/grav-plugin-api) versions before 1.0.14. The flaw exists in the userPassesAuthorize() function, which improperly authorizes requests by ignoring API key scopes and relying solely on the super-admin flag and ACL grants. This allows an authenticated attacker with a scoped API key from a privileged account to bypass scope restrictions and access UI metadata and item definitions that should be restricted, leading to information disclosure.
Grav versions before 2.0.14 contain a stored cross-site scripting (XSS) vulnerability in the Security::detectXss() function. This flaw allows an authenticated user with page-edit permissions to inject malicious JavaScript that executes in the browsers of visitors viewing the affected page. The vulnerability arises because invalid UTF-8 bytes cause the XSS detection patterns to fail silently, bypassing the save-time XSS safety checks.
CVE-2026-75833 is an open redirect vulnerability in the Grav API plugin's SsoController::sanitizeReturnTo() function before version 1.0.14. The function attempts to block URLs with a '//' prefix but fails to handle browser normalization of backslashes to slashes, allowing crafted returnTo parameters like '/\evil.com' to redirect users to attacker-controlled sites after OAuth login. This can enable post-login phishing attacks. Exploitability depends on the client-side OAuth callback handler and was not independently verified.
CVE-2026-75832 is a critical missing authorization vulnerability in the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.15. The flaw exists in the BlueprintPathResolver::resolveUserScope() method, which incorrectly authorizes access based on the super-admin ACL flag of the account rather than the actual API key scope. This allows an attacker with an API key scoped only to api.media.write but minted on a super-admin account to write files into another user's scope and browse that user's file listings, despite lacking explicit api.users.write permissions.
Grav versions before 2.0.15 contain a stored cross-site scripting (XSS) vulnerability in the audio and video media rendering functionality. This occurs because the media URL fragment is concatenated without proper escaping into raw HTML source elements, allowing attackers to inject arbitrary HTML and JavaScript that execute in the context of users' sessions.
A path traversal vulnerability exists in grav-plugin-api versions from 0 up to 1.0.14 in the PagesController::batchCopy() method. Authenticated users with editor-level permissions can exploit this flaw by supplying crafted path traversal sequences in the 'suffix' parameter to write arbitrary files outside the intended directory. This vulnerability allows unauthorized file writes to locations writable by the web server. The issue is fixed in version 1.0.15.
CVE-2026-75829 is a high-severity vulnerability in the grav-plugin-api component of the getgrav grav CMS. Versions before 1.0.15 do not properly validate Twig template content submitted via the translate() endpoint. This allows attackers with api.pages.write permission to inject server-side template code that is executed when the page is rendered.
Grav versions before 2.0.15 contain a stored cross-site scripting (XSS) vulnerability in the detectXss() function. This flaw allows authenticated editors to inject event handlers such as onerror= that bypass validation due to improper neutralization of unpaired quotes in unquoted attribute values. When page content is rendered, these injected event handlers execute in visitor browsers, potentially leading to high-impact XSS attacks.
Grav versions before 2.0.15 have a critical vulnerability allowing attackers with page-edit or blueprint-config access to perform arbitrary file writes via an incomplete denylist in the Blueprint dynamic-data validation. This can lead to remote code execution by appending PHP payloads to web-accessible files through the error_log function.
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.
CVE-2026-74908 is a cross-site scripting (XSS) vulnerability in the Grav plugin-api before version 1.0.15. The issue arises because the SVG sanitizer only validates files with the exact '.svg' extension, allowing files with '.svgz' and '.xhtml' extensions to bypass sanitization. Attackers with api.media.write permission can upload malicious files containing executable scripts that run in the context of the site when accessed by administrators or visitors.
Grav versions before 2.0.15 have a path traversal vulnerability in the static asset server within index.php. The vulnerability arises from improper pathname limitation using string prefix matching rather than proper directory-boundary validation. This allows unauthenticated attackers to access files in sibling directories by exploiting directory names that extend the base path string.
The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin()-gated write endpoints (in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController). These endpoints authorize via a super-admin early-return that never invokes requirePermission()—the sole enforcement point of the scope cap—so a 'read-only'-scoped key (e.g. api.pages.read) can perform super-only write operations, including rewriting group ACL maps to grant super-admin privileges to arbitrary accounts. A leaked or delegated read-only CI/monitoring key can therefore gain full super-admin write capability. Fixed in 1.0.13.
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `<` and uses `[^>]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `<img src=x title=">" onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.
The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. The scope cap is applied only inside requirePermission(), while the scheduler and backups gates use a bare isSuperAdmin() check that never consults api_key_scopes. An attacker holding an API key scoped to api.config.write that was minted on a super account can therefore inject arbitrary commands into scheduler.custom_jobs, which Job::run() passes to a Symfony Process, achieving operating system command execution as the web server user.
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a result, an api.users.write-scoped key minted on a super account can set access.api.super or assign a super-granting group to mint or promote a full super account, then authenticate as that account for uncapped administrative privileges.
Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so a least-privilege API key (scoped to api.users.write) minted on a super account can create an invitation record containing super-admin access flags. When the invitation is accepted, those flags are written verbatim to the new account, resulting in privilege escalation to a fully controlled super account.
Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.