CVE-2026-75832 getgrav CVE debrief

Who should care

Defenders responsible for Grav installations, particularly those using the Grav API plugin, should assess exposure and prioritize patching to prevent potential unauthorized file writes.

Why it matters

The Grav API plugin vulnerability allows attackers to bypass authorization and write files to other user scopes, potentially leading to unauthorized privilege escalation and data tampering.

• Potential unauthorized file writes to user scopes
• Bypassing of authorization checks for API key holders
• Elevation of privileges for attackers with limited API key scopes
• Need for verification of affected versions and exposure

Technical summary

The Grav API plugin (getgrav/grav-plugin-api) before version 1.0.14 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method incorrectly gates the users/<name> scope on the account's raw super-admin ACL flag (access.api.super) instead of validating the presented API key's actual scope. This allows an attacker holding an API key scoped only to api.media.write minted on a super-admin account to bypass the authorization check and write a file into another user's scope via POST /blueprint-upload or GET /blueprint-files.

Defensive priority

Defenders should prioritize verifying affected versions, assessing exposure, and applying patches to prevent potential unauthorized file writes.

Recommended defensive actions

• Verify if the Grav API plugin version is 1.0.14 or earlier and update to 1.0.15 or later
• Assess exposure by reviewing API key scopes and user permissions
• Implement additional monitoring for potential unauthorized file writes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and exploitation is limited. The vulnerability was fixed in version 1.0.15 of the Grav API plugin. Defenders should verify if the Grav API plugin version is 1.0.14 or earlier and update to 1.0.15 or later. The CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessments. However, further research is needed to determine the full scope of affected systems and potential exploitation

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.