A missing-authorization flaw in the Grav grav-plugin-api plugin before 1.0.8 lets any low-privileged panel user forge persistent API keys for other accounts, opening the door to impersonation and full account takeover.
What Is It
CVE-2026-65007 is a missing authorization vulnerability (CWE-862) in the Grav api plugin (grav-plugin-api). The plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks before the account-management ACL runs, and authorizes the caller against only the admin.login permission; the baseline permission held by every panel user. As a result, any user with admin.login can mint a persistent API key bound to any account, and the forged key inherits that target account's API permissions.
Why It Matters
On installs where an API-enabled account holds broader permissions, an attacker can leverage a forged key for account impersonation and privilege escalation up to account takeover. The flaw is network-exploitable with low attack complexity and no user interaction. NVD assigns it a CVSS 3.1 base score of 9.6 (CRITICAL) with a changed scope and high confidentiality and integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). VulnCheck's secondary CVSS 4.0 score is 8.7 (HIGH).
What's Vulnerable
- Product: Grav (
getgrav/grav) with thegrav-plugin-apiplugin - Affected versions: all versions before 1.0.8
- Fixed version: 1.0.8 (and later)
Patch Status
The issue is resolved in grav-plugin-api version 1.0.8. Administrators running any earlier version should upgrade the plugin to 1.0.8 or later. This CVE does not appear in the CISA KEV catalog, and no confirmed active exploitation is reported in the supplied source material.
Sources
- NVD, CVE-2026-65007: https://nvd.nist.gov/vuln/detail/CVE-2026-65007
- GitHub Security Advisory GHSA-7v74-m76q-8wf3: https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3
- VulnCheck Advisory: https://www.vulncheck.com/advisories/grav-before-missing-authorization-on-api-key-generation