CVE-2026-64852

8.7 highEPSS 0.4%

High (8.7). EPSS 0.4% chance of exploitation in the next 30 days.

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-08-19
Modified: 2026-09-09
Record from: the NVD, synced 2026-10-19

References

https://github.com/getgrav/grav-plugin-api/commit/ed16f0aaa9b398c6f179fb8f51e0fa53e4ed8a30
https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.8
https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3
https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3

Check your stack JSON