CVE-2026-62667

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey stores a declared scopes array, but ApiKeyAuthenticator::authenticate does not read keyDatascopes and returns the owning user's...

EUVD-2026-58637

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...

PT-2026-71992

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.13 Description A scope cap bypass exists in the DemoController of the Grav API plugin. The private requireSuper function checks isSuperAdmin and returns early, skipping the requirePermission function where...