CVE-2026-62231
HIGHGrav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator
Title source: cnaDescription
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created with limited scopes (e.g. read-only) can perform any write, delete, or administrative operation the owning user is authorized for. Fixed in 1.0.6.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-x7hm-jc32-v39j)
https://github.com/getgrav/grav/security/advisories/GHSA-x7hm-jc32-v39j
Third Party Advisory third-party-advisory
VulnCheck Advisory: Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator
https://www.vulncheck.com/advisories/grav-api-key-scope-bypass-via-apikeyauthenticator
Scores
CVSS v3
8.1
EPSS
0.0022
EPSS Percentile
12.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-863
Status
published
Products (2)
getgrav/grav
< 1.0.6
getgrav/grav
1.0.6
Published
Jul 17, 2026
Tracked Since
Jul 17, 2026