CVE-2026-75835 getgrav CVE debrief

Who should care

Defenders responsible for Grav installations, particularly those using the API plugin, should assess exposure and prioritize remediation due to the high CVSS score and potential for information disclosure.

Why it matters

CVE-2026-75835 is a critical vulnerability in the Grav API plugin that allows authenticated attackers to bypass API key scope restrictions, potentially leading to information disclosure. Defenders should prioritize verification, remediation, and monitoring to mitigate this risk.

• Potential information disclosure of sensitive metadata and item definitions
• Bypassing of scope restrictions for API keys
• Increased risk of lateral movement or privilege escalation
• Need for verification of API key scope configurations and ACL grants

Technical summary

The Grav API plugin (getgrav/grav-plugin-api) before version 1.0.14 contains a missing authorization vulnerability in the userPassesAuthorize() function. This function fails to consult the calling request's API key scopes, instead relying on the account's raw super-admin flag and ACL grants. An authenticated attacker with a scoped API key minted on a privileged account can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions.

Defensive priority

Defenders should prioritize verifying and upgrading to version 1.0.14 or later of the Grav API plugin, restricting API key scopes, and monitoring for suspicious API access.

Recommended defensive actions

• Verify and upgrade to version 1.0.14 or later of the Grav API plugin
• Restrict API key scopes to limit access
• Monitor API access for suspicious activity
• Review and adjust ACL grants and super-admin flags
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. However, the corpus lacks specific information on exploitation and affected systems. The vulnerability was publicly disclosed on August 18, 2026, and last modified on September 8, 2026. The affected product is the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.14. The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.