CVE-2026-75836

The Grav API plugin before 1.0.14 omits the authorize check in MenubarController::executeAction(), so any authenticated caller with api.access can invoke privileged menubar actions via POST /api/v1/menubar/actions/{plugin}/{action}, bypassing plugin-level authorization. No in-the-wild exploitatio...

CVE-2026-75835 Grav API Plugin before 1.0.14 Missing Authorization

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

CVE-2026-75835

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

CVE-2026-75833

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...

CVE-2026-75833 Grav API Plugin Open Redirect via Backslash Bypass

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...

CVE-2026-75833

The Grav API plugin (bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 has an open redirect in SsoController::sanitizeReturnTo(): a backslash-prefix like /\evil.com bypasses the // guard and is normalized by browsers to //evil.com, enabling post-OAuth-login phishing. Exploitatio...

CVE-2026-75833 Grav API Plugin Open Redirect via Backslash Bypass

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...

CVE-2026-75832

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

CVE-2026-75832

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 contains a missing authorization flaw in BlueprintPathResolver::resolveUserScope() . The method checks the account's raw super-admin ACL flag (access.api.super) instead of validating the presented API key's...

CVE-2026-75832 Grav API Plugin before 1.0.14 Authorization Bypass

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

CVE-2026-75832 Grav API Plugin before 1.0.14 Authorization Bypass

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

CVE-2026-75836: Missing Authorization

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction. While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize, the POST...

PT-2026-76936

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction. While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize, the POST...

PT-2026-76935

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

CVE-2026-75832: Missing Authorization

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

PT-2026-76933

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...

CVE-2026-75835: Missing Authorization

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

PT-2026-76932

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

CVE-2026-72833

The Grav API plugin (getgrav/grav-plugin-api) versions 1.0.6–1.0.11 contain a privilege-escalation vulnerability. A scoped API key minted on a super-admin account bypasses the scope cap on four isSuperAdmin()-gated write endpoints (GroupsController, AccountsConfigController, PreferencesController...

CVE-2026-72833 Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys

The Grav API plugin getgrav/grav-plugin-api versions = 1.0.6 and = 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin-gated write endpoints in GroupsController, AccountsConfigController,...