Security Advisory

CVE-2026-64852

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-19 16:00:06

Last updated 2026-08-19 17:25:09

Assigner GitHub_M

CVSS score 8.7

State PUBLISHED

Description

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.

← Browse all CVEs View on cve.org ↗