CVE-2026-75836

The Grav API plugin before 1.0.14 omits the authorize check in MenubarController::executeAction(), so any authenticated caller with api.access can invoke privileged menubar actions via POST /api/v1/menubar/actions/{plugin}/{action}, bypassing plugin-level authorization. No in-the-wild exploitatio...

EUVD-2026-60600

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction. While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize, the POST...

CVE-2026-75835

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 has a missing authorization flaw in userPassesAuthorize() (AbstractApiController.php): it checks the account's raw super-admin flag and ACL grants instead of the calling request's API key scopes. An authenticated attacker with a scoped A...

EUVD-2026-60599

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

CVE-2026-75835 Grav API Plugin before 1.0.14 Missing Authorization

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

CVE-2026-75835

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

CVE-2026-75835 Grav API Plugin before 1.0.14 Missing Authorization

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

CVE-2026-75833 Grav API Plugin Open Redirect via Backslash Bypass

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...

CVE-2026-75833

The Grav API plugin (bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 has an open redirect in SsoController::sanitizeReturnTo(): a backslash-prefix like /\evil.com bypasses the // guard and is normalized by browsers to //evil.com, enabling post-OAuth-login phishing. Exploitatio...

CVE-2026-75832

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

CVE-2026-75832

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 contains a missing authorization flaw in BlueprintPathResolver::resolveUserScope() . The method checks the account's raw super-admin ACL flag (access.api.super) instead of validating the presented API key's...

CVE-2026-75832 Grav API Plugin before 1.0.14 Authorization Bypass

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

EUVD-2026-60596

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

EUVD-2026-60594

grav-plugin-api getgrav/grav-plugin-api versions = 1.0.0-beta.10 and = 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter via POST /api/v1/pages/batch unvalidated. An...

CVE-2026-75830

grav-plugin-api (getgrav/grav-plugin-api) versions 1.0.0-beta.10 through 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for a prior advisory (GHSA-qjq4-jp55-4mx2) left the user-controlled suffix parameter in POST /api/v1/pages/batch unv...

CVE-2026-75830 grav-plugin-api before 1.0.15 Path Traversal via batchCopy

grav-plugin-api getgrav/grav-plugin-api versions = 1.0.0-beta.10 and = 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter via POST /api/v1/pages/batch unvalidated. An...

CVE-2026-75829

The grav-plugin-api plugin (versions before 1.0.15) does not validate Twig content submitted to the translate() endpoint. An authenticated attacker with api.pages.write permission can persist pages with process.twig enabled and inject crafted header/content parameters, resulting in server-side te...

EUVD-2026-60593

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection...

CVE-2026-75829 grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection...

EUVD-2026-60589

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing...