The Grav API plugin (grav-plugin-api) versions 1.0.16 through before 1.0.42 contain multiple vulnerabilities. An unauthenticated GET endpoint caches large translation dictionaries per language code, enabling resource exhaustion attacks. Additionally, versions before 1.0.42 fail to enforce page-level rules in sync and batch copy endpoints, allowing accounts with api.pages.write permission to overwrite translations or create unauthorized pages. These issues are fixed in version 1.0.42.
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.
CVE-2026-63407 is a high-severity vulnerability in the Grav API Plugin for Grav CMS. Prior to version 1.0.0-rc.16, the plugin's CORS middleware allowed any origin to access authenticated API endpoints by returning Access-Control-Allow-Origin: *. This permissive cross-domain policy enables JavaScript from any origin to submit attacker-obtained JWT tokens and perform actions with the token owner's privileges, including reading data and modifying accounts. The issue is fixed in version 1.0.0-rc.16.
CVE-2026-62667 is a missing authorization vulnerability in the Grav API Plugin for Grav CMS versions prior to 1.0.6. The flaw allows an API key issued with limited scopes to bypass scope restrictions and perform all actions available to the owning user, including write, delete, and administrative operations. This occurs because the authentication process does not properly enforce declared scopes, leading to excessive permissions. The issue is fixed in version 1.0.6.
A vulnerability in Grav API Plugin prior to version 1.0.6 allows a non-super user with api.users.write permission to create an API key with super-administrator privileges. This occurs because certain user mutation endpoints omit a critical access check, enabling unauthorized privilege escalation and manipulation of two-factor authentication settings. The issue is fixed in version 1.0.6.
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.
CVE-2026-61607 is a cross-site scripting (XSS) vulnerability in the Grav API Plugin for Grav CMS. Versions prior to 1.0.2 do not properly sanitize SVG files uploaded via the POST /api/v1/media endpoint, allowing attackers with api.media.write permission to upload SVGs containing malicious JavaScript. When these SVG files are served with the image/svg+xml content type, the embedded script executes in the victim's browser, potentially leading to session data theft and unauthorized actions. This vulnerability is fixed in version 1.0.2.
CVE-2026-75832 is a critical missing authorization vulnerability in the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.15. The flaw exists in the BlueprintPathResolver::resolveUserScope() method, which incorrectly authorizes access based on the super-admin ACL flag of the account rather than the actual API key scope. This allows an attacker with an API key scoped only to api.media.write but minted on a super-admin account to write files into another user's scope and browse that user's file listings, despite lacking explicit api.users.write permissions.
A path traversal vulnerability exists in grav-plugin-api versions from 0 up to 1.0.14 in the PagesController::batchCopy() method. Authenticated users with editor-level permissions can exploit this flaw by supplying crafted path traversal sequences in the 'suffix' parameter to write arbitrary files outside the intended directory. This vulnerability allows unauthorized file writes to locations writable by the web server. The issue is fixed in version 1.0.15.
CVE-2026-75829 is a high-severity vulnerability in the grav-plugin-api component of the getgrav grav CMS. Versions before 1.0.15 do not properly validate Twig template content submitted via the translate() endpoint. This allows attackers with api.pages.write permission to inject server-side template code that is executed when the page is rendered.
The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin()-gated write endpoints (in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController). These endpoints authorize via a super-admin early-return that never invokes requirePermission()—the sole enforcement point of the scope cap—so a 'read-only'-scoped key (e.g. api.pages.read) can perform super-only write operations, including rewriting group ACL maps to grant super-admin privileges to arbitrary accounts. A leaked or delegated read-only CI/monitoring key can therefore gain full super-admin write capability. Fixed in 1.0.13.
Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so a least-privilege API key (scoped to api.users.write) minted on a super account can create an invitation record containing super-admin access flags. When the invitation is accepted, those flags are written verbatim to the new account, resulting in privilege escalation to a fully controlled super account.
The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super account can submit an empty scopes array to mint an unscoped, full-access super key, bypassing scope restrictions (and enabling further chains such as configuration write to RCE).
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks isSuperAdmin() and returns early before invoking requirePermission(), so the api_key_scopes cap (enforced only in requirePermission()) is skipped. As a result, any scoped API key minted on a super account can bypass its scope restrictions when calling the baseline() and reset() operations (e.g. POST /api/v1/demo/reset), allowing it to capture the demo baseline or force a demo reset. Impact is bounded to demo-engine control and is conditional on demo mode being configured with writable resources.
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension() inspects only the final file extension via pathinfo($filename, PATHINFO_EXTENSION), so a user with api.media.write permission can upload a file with a double extension such as shell.php.jpg to bypass the dangerous extensions blocklist. The web server may then execute the file as PHP, resulting in remote code execution.
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile() method validates only the file extension and never invokes Security::sanitizeSVG(), so an authenticated attacker with the api.media.write permission can upload an SVG containing arbitrary JavaScript. The file is stored unmodified and served with Content-Type: image/svg+xml; when an administrator opens it in a browser (directly or via <object>/<iframe>), the embedded script executes in their session context, enabling cookie theft and session hijacking.
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.