CVE-2026-64852: Getgrav Grav-Plugin-API

High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.

Affected products

• Getgrav Grav-Plugin-API: before 1.0.8 (fixed in 1.0.8)

Published 2026-08-19. Last modified 2026-09-09.