CVE-2026-80203: Getgrav Grav

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.

Affected products

• Getgrav Grav: before 1.0.18 (fixed in 1.0.18)

Published 2026-08-26. Last modified 2026-09-03.