CVE-2026-62666
NVD analysis in progress
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApiKeyPermission(), obtain the target's full privileges because key scopes are not enforced, and create persistent super-administrator access; the same missing check also permits rotating or disabling the target's two-factor authentication. This issue is fixed in version 1.0.6.
What this means
- Exposure
- Exploitable remotely over the network, with an ordinary user account and with no action from the victim.
- Impact
- An attacker can read sensitive data, modify or destroy data and take the service offline.
- Weakness
- Changing an identifier in the request grants access to another user’s data.
- Likelihood
- Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.
What to doFold into the next patch cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.