CVE-2026-64852

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.

• CWE-862

• https://github.com/getgrav/grav-plugin-api/commit/ed16f0aaa9b398c6f179fb8f51e0fa53e4ed8a30
• https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.8
• https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3
• https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64846Nix is a package manager for Linux and other Unix systems. P…2.8
• CVE-2026-64847AnyIO is a high level asynchronous concurrency and networkin…6.8
• CVE-2026-64849MLflow is an open source AI engineering platform for agents,…9.3
• CVE-2026-6485UEFI BIOS embedded Shell could be used to bypass Secure Boot…8.2
• CVE-2026-64850Grav is a file-based Web platform. Prior to 2.0.7, Grav Blue…8.7
• CVE-2026-64851Grav Shortcode Core Plugin allows for the development shortc…8.5
• CVE-2026-64856FileRise is a self-hosted web-based file manager with multi-…3.7
• CVE-2026-64857tirreno, a security framework, has a session fixation issue …5.3
• CVE-2026-64859New API is a large language mode (LLM) gateway and artificia…9.1
• CVE-2026-6486A vulnerability was detected in classroombookings up to 2.17…3.5
• CVE-2026-64860ESP-Protocols is a collection of protocol components for ESP…6.5
• CVE-2026-64862Frappe HR is an open-source human resources management solut…6.5