CVE-2026-80204

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin()/hasPermission() checks without a request parameter, it cannot enforce scopeAllows(). A caller holding a scoped API key may therefore see (and potentially edit) page permission fields beyond the scope granted to the key. The end-to-end write-time impact was not fully confirmed by the reporter.

• CWE-863

• https://github.com/getgrav/grav/security/advisories/GHSA-mcx6-4rvg-7r8v
• https://www.vulncheck.com/advisories/grav-before-1.0.18-authentication-bypass-via-scoped-api-key-2

Published

Aug 26, 2026

Last Modified

Sep 3, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-80199Kimai before 2.54.0 contains a timing oracle vulnerability i…3.7
• CVE-2026-8020Uninitialized Use in GPU in Google Chrome on Android prior t…5.3
• CVE-2026-80200Kimai before 2.53.0 contains an open redirect vulnerability …4.7
• CVE-2026-80201Kimai before 2.53.0 fails to block sensitive User methods in…2
• CVE-2026-80202Kimai before 2.56.0 does not enforce team-membership checks …8.8
• CVE-2026-80203The getgrav/grav-plugin-api plugin before 1.0.18 does not en…9.8
• CVE-2026-80205NLTK versions before 3.10.0 contain a regular expression den…7.5
• CVE-2026-80206NLTK before 3.10.3 contains a regular expression denial of s…5.9
• CVE-2026-80207APITable through 1.13.0-beta.1 annotates the create handler …5.3
• CVE-2026-80208APITable through 1.13.0-beta.1 annotates both getUserHistori…8.2
• CVE-2026-80209The updateWorkspace handler in mods/identity/src/workspaces/…4.3
• CVE-2026-8021Script injection in UI in Google Chrome prior to 148.0.7778.…4.2