CVE-2026-75835

Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a result, an authenticated attacker holding a scoped API key minted on a privileged account can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions (sidebar/menubar/widget items and users-list columns/row-actions/filter-tabs) that their key scope should deny, resulting in information disclosure.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/getgrav/grav/security/advisories/GHSA-p57v-xhv3-mf2w
https://www.vulncheck.com/advisories/grav-api-plugin-before-missing-authorization
https://github.com/getgrav/grav/security/advisories/GHSA-p57v-xhv3-mf2w

Configurations

No configuration.

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El plugin Grav API (getgrav/grav-plugin-api) anterior a la versión 1.0.14 contiene una vulnerabilidad de autorización faltante en userPassesAuthorize() (AbstractApiController.php). La función no consulta los alcances de la clave API de la solicitud llamante, confiando en su lugar en el indicador de superadministrador sin procesar de la cuenta y las concesiones de ACL. Como resultado, un atacante autenticado que posee una clave API con alcance acuñada en una cuenta privilegiada puede eludir sus restricciones de alcance declaradas para acceder a metadatos de interfaz de usuario y definiciones de elementos protegidos por autorización (elementos de barra lateral/barra de menú/widget y columnas de lista de usuarios/acciones de fila/pestañas de filtro) que su alcance de clave debería denegar, lo que resulta en revelación de información.

Information

Published : 2026-08-18 12:19

Updated : 2026-10-22 22:10

NVD link : CVE-2026-75835

Mitre link : CVE-2026-75835

CVE.ORG link : CVE-2026-75835

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-75835", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75835", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T15:09:42.525936Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.14", "versionType": "semver"}, {"status": "unaffected", "version": "1.0.14", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-18T12:19:33.647", "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-p57v-xhv3-mf2w", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/grav-api-plugin-before-missing-authorization", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-p57v-xhv3-mf2w", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a result, an authenticated attacker holding a scoped API key minted on a privileged account can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions (sidebar/menubar/widget items and users-list columns/row-actions/filter-tabs) that their key scope should deny, resulting in information disclosure."}, {"lang": "es", "value": "El plugin Grav API (getgrav/grav-plugin-api) anterior a la versi\u00f3n 1.0.14 contiene una vulnerabilidad de autorizaci\u00f3n faltante en userPassesAuthorize() (AbstractApiController.php). La funci\u00f3n no consulta los alcances de la clave API de la solicitud llamante, confiando en su lugar en el indicador de superadministrador sin procesar de la cuenta y las concesiones de ACL. Como resultado, un atacante autenticado que posee una clave API con alcance acu\u00f1ada en una cuenta privilegiada puede eludir sus restricciones de alcance declaradas para acceder a metadatos de interfaz de usuario y definiciones de elementos protegidos por autorizaci\u00f3n (elementos de barra lateral/barra de men\u00fa/widget y columnas de lista de usuarios/acciones de fila/pesta\u00f1as de filtro) que su alcance de clave deber\u00eda denegar, lo que resulta en revelaci\u00f3n de informaci\u00f3n."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "disclosure@vulncheck.com"}