CVE-2026-62666 getgrav CVE debrief

Who should care

Users of Grav CMS with Grav API Plugin installed, especially those with non-super administrator accounts having 'api.users.write' permissions, should verify and apply patch version 1.0.6. They should also restrict 'api.users.write' permissions to super-administrators and monitor for suspicious API key creation and 2FA changes. Additionally, security teams and platform operators should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions and retest remediated assets after evidence is documented to ensure the vulnerability is properly mitigated within their environments and asset inventories are updated accordingly to reflect current exposure levels and patch status across all managed environments and deployments of Grav CMS with the Grav API Plugin installed, considering both immediate remediation needs and longer-term vulnerability management practices to address potential future issues with similar impact or severity ratings as CVE-2026-62666, which is rated HIGH with a CVSS score of 8.8 and affects multiple user roles and system configurations across various deployment scenarios of Grav CMS and Grav API Plugin versions prior to 1.0.6, necessitating thorough review of current configurations, user permissions, and system updates to ensure comprehensive mitigation and minimize potential operational impact through effective defensive prioritization and compensating control implementation where patching may not be immediately feasible across all affected systems or deployments, especially in environments with complex change management processes or limited immediate access to updated versions of the Grav API Plugin or Grav CMS software components that may be required to address CVE-2026-62666 effectively without introducing additional security risks or operational disruptions during remediation efforts across different managed environments and IT infrastructures that may be impacted by this vulnerability in Grav API Plugin versions prior to 1.0.6, highlighting the need for careful planning, coordination, and execution of remediation activities to ensure successful mitigation of CVE-2026-62666 with minimal

Technical summary

CVE-2026-62666: Grav API Plugin prior to 1.0.6 has a vulnerability allowing non-super accounts to create API keys with super-admin privileges due to missing access checks in UsersController::createApiKey(), generate2fa(), and disable2fa(). This issue permits rotating or disabling the target's two-factor authentication and obtain the target's full privileges because key scopes are not enforced. The vulnerability is fixed in version 1.0.6.

Defensive priority

CVE-2026-62666 is rated HIGH with a CVSS score of 8.8; verify and apply patch version 1.0.6 for Grav API Plugin to mitigate API key and 2FA vulnerabilities.

Recommended defensive actions

• Verify and apply patch version 1.0.6 for Grav API Plugin
• Restrict 'api.users.write' permissions to super-administrators
• Monitor for suspicious API key creation and 2FA changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets after evidence is documented
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-62666 issue allows non-super accounts with 'api.users.write' permission to create API keys bound to 'access.api.super', granting full privileges due to unenforced key scopes. To verify affected systems, defenders should check for the presence of Grav API Plugin version prior to 1.0.6 and review API key creation and 2FA changes. Evidence is limited, and further verification is required to confirm affected scope and severity.

Official resources