CVE-2026-62666 Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super

🗓️ 19 Aug 2026 15:36:37Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Grav API Plugin 1.0.6 allows non-super api.users.write users to mint super-admin API keys and bypass 2FA via missing accessGrantsSuper checks.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-62233	17 Jul 202600:07	–	attackerkb
Circl	CVE-2026-62233	17 Jul 202602:53	–	circl
CVE	CVE-2026-62233	17 Jul 202600:07	–	cve
Cvelist	CVE-2026-62233 grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey	17 Jul 202600:07	–	cvelist
EUVD	EUVD-2026-45121	17 Jul 202600:07	–	euvd
NVD	CVE-2026-62233	17 Jul 202602:18	–	nvd
Positive Technologies	PT-2026-60643	17 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-62233 grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey	17 Jul 202600:07	–	vulnrichment

Source	Link
github	www.github.com/getgrav/grav-plugin-api/releases/tag/1.0.6
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62666.json
github	www.github.com/getgrav/grav/security/advisories/GHSA-8gg4-rvvv-cq96
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-62666
github	www.github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e

21 Aug 2026 03:46Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.18.8

EPSS0.00246