External risk intelligence

Grav API Plugin Authorization Bypass.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-75832

The vulnerability exists in an API plugin for a CMS, which is commonly deployed as an internet-facing service. The flaw resides in an authentication/authorization mechanism exposed via network endpoints (e.g., POST/GET) used for administrative or management tasks, making these endpoints likely to be reachable from the internet in standard web application deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the Grav API plugin, which is part of the Grav content management system. The issue relates to how the plugin verifies user permissions, potentially allowing unauthorized access and file manipulation for users with specific, limited API keys. The main concern is confirming the relevance and exposure of this plugin within your environment.

Unauthorized API key use could alter user files.
Affects authorization controls in an API plugin.
Confirm plugin relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by using an API key with write access to media files, which is minted on an account with super-admin privileges. This key, though limited, can bypass authorization checks when interacting with the API's blueprint upload or file browsing features. The attacker can then write files into another user's directory, potentially leading to unauthorized access or modification of user data.

Network access required for API interaction.
Insecure API endpoints for file uploads.
Unauthorized file write and scope browsing.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker with a specific API key to write files into another user's scope within the Grav system, despite the key not having the necessary permissions. This could lead to unauthorized modification of user-specific data.

User account data could be modified.
Unauthorized file writes may occur.
User data could be altered unexpectedly.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Grav's API plugin, likely managed by application owners or platform teams responsible for the Grav CMS. The immediate priority is to identify all instances of the affected plugin, determine their exposure and criticality, and then plan remediation.

Identify Grav API plugin instances.
Confirm reachability and criticality.
Coordinate remediation with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Grav API plugin?

The Grav API plugin is a component bundled with Grav 2.0, a popular flat-file content management system. It provides an interface for programmatic interaction with the site, allowing developers or administrators to manage content, media, and user configurations remotely via API requests rather than the standard web dashboard.

How does CVE-2026-75832 work?

This vulnerability is a Missing Authorization flaw, categorized as CWE-862. It occurs because the system mistakenly checks for a global super-admin status to grant access instead of verifying if an individual API key actually holds the specific permission required for the action. Consequently, a key with limited rights can perform elevated tasks like browsing or writing files in restricted user directories.

Do I need a super-admin account to trigger this?

Yes, the vulnerability requires an attacker to possess a legitimate API key minted from a super-admin account. While the key itself can be scoped to limited tasks like media management, the underlying flaw relies on the account's broader privileges to bypass security checks. Simply possessing a standard or non-privileged API key is insufficient to trigger this specific bypass.

Is my installation at risk if it faces the internet?

According to Halo Surface Signal, this vulnerability is highly relevant for internet-facing deployments. Because the API plugin manages administrative tasks over network endpoints, any Grav instance with these endpoints exposed to the public internet is at a higher risk of unauthorized interaction compared to services restricted to internal, private networks.

When should I update the Grav API plugin?

You should prioritize updating immediately to version 1.0.15 or later. First, audit your environment to identify all active instances of the Grav API plugin. Once identified, verify their network accessibility to determine the urgency for your specific setup, then coordinate with your technical team to apply the patch provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.