CVE-2026-80204 getgrav CVE debrief

Who should care

Administrators and users of Grav API plugin versions before 1.0.18 should be aware of the potential for unauthorized access to page permission fields and take steps to mitigate the issue. This includes reviewing and restricting API key scopes to minimize potential impact, monitoring for suspicious activity related to page permission changes, and prioritizing patching to prevent potential unauthorized access. Security teams should also assess the vulnerability's impact on their organization's assets and prioritize remediation efforts accordingly. Additionally, operators and platform administrators should review the vulnerability's details and plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed. Vulnerability management teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Affected product deployments in managed environments should be identified and assigned an owner for follow-up. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. The vulnerability's impact on security teams and asset inventory management should also be assessed. Rollback change windows and source tracking should be considered as part of the remediation process. This should be done by reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. The CVE record and official NIST NVD detail page provide source-specific vulnerability assessments that can inform these efforts. By taking these steps, organizations can minimize the risk associated with this vulnerability and ensure the security of their systems and data. Security teams should also consider the operational impact of this vulnerability and prioritize remediation efforts accordingly. The vulnerability's technical details and defensive impact should be reviewed to ensure a comprehensive understanding of the issue and its potential consequences. This includes assessing the vulnerability's technical framing and source-grounded facts

Technical summary

The Grav API plugin before version 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController. This allows a caller holding a scoped API key to potentially see and edit page permission fields beyond the scope granted to the key. The issue arises from raw isSuperAdmin()/hasPermission() checks without a request parameter, which cannot enforce scopeAllows().

Defensive priority

Organizations using Grav API plugin versions before 1.0.18 should prioritize patching to prevent potential unauthorized access to page permission fields.

Recommended defensive actions

• Patch Grav API plugin to version 1.0.18 or later
• Review and restrict API key scopes to minimize potential impact
• Monitor for suspicious activity related to page permission changes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-80204 record indicates that the Grav API plugin before version 1.0.18 does not properly enforce API-key scope caps, potentially allowing scoped API key holders to access and edit page permission fields beyond their granted scope. The end-to-end write-time impact was not fully confirmed by the reporter. To verify, defenders should review the plugin's API key scope implementation and assess the potential impact on their systems. They should also monitor for suspicious activity related to page permission changes and review compensating controls for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.