CVE-2026-62666highCWE-639CWE-862

CVE-2026-62666: falha de alta gravidade em getgrav grav-plugin-api

Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar grav-plugin-api

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.6%
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApiKeyPermission(), obtain the target's full privileges because key scopes are not enforced, and create persistent super-administrator access; the same missing check also permits rotating or disabling the target's two-factor authentication. This issue is fixed in version 1.0.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
getgrav · grav-plugin-api
CVEs relacionadas — getgrav grav-plugin-api

No mesmo produto, das mais perigosas para as menos.

CVE-2026-112779CRITICALGrav API Plugin before 1.0.42 Cache Exhaustion and Page Permission BypassEPSS 0.8%CVE-2026-63408HIGHGrav API Plugin: JWT Access Token Accepted via `?token=` URL Query ParameterEPSS 0.5%CVE-2026-72833HIGHGrav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API KeysEPSS 0.5%CVE-2026-72826HIGHGrav API Plugin before 1.0.13 Scope Bypass via createApiKeyEPSS 0.5%CVE-2026-62668CRITICALGrav API Plugin: Webhook SSRF via Unrestricted cURL ProtocolsEPSS 0.4%CVE-2026-86196HIGHGrav API Plugin before 1.0.20 Authentication Bypass via Host HeaderEPSS 0.4%