CVE-2026-75832

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 contains a missing authorization flaw in BlueprintPathResolver::resolveUserScope() . The method checks the account's raw super-admin ACL flag (access.api.super) instead of validating the presented API key's...