External risk intelligence

Grav API Plugin Missing Authorization Vulnerability Reveals UI Metadata

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-75835

The vulnerability exists in an API plugin for a web-based CMS. Grav is typically deployed as a public-facing web application, and the API component is commonly used to expose functionality to external clients or integrated services, making it a regular part of the public-facing attack surface.

Information Disclosure

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the Grav API plugin, affecting how authorization is handled. This could allow unauthorized access to sensitive system information through improperly restricted API access.

The API plugin improperly handles user authorization.
Leadership should remember this affects web application security.
Confirm relevance and exposure of this API plugin.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by first gaining authenticated access to the Grav API with a specially crafted, limited API key. This key, while supposedly restricted, is used to interact with the `userPassesAuthorize()` function. Because this function improperly checks the API key's permissions, it can be tricked into revealing sensitive UI metadata and item definitions that the attacker should not have access to.

Authenticated access required.
Triggered by unauthorized API key use.
Leads to sensitive information disclosure.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authenticated attacker with a scoped API key could bypass scope restrictions to access UI metadata and item definitions that their key scope should deny, resulting in information disclosure.

UI metadata and item definitions at risk.
API key scope restrictions could be bypassed.
Information disclosure could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Grav API plugin's missing authorization flaw primarily impacts application owners and potentially platform teams if the plugin is managed as part of a larger platform. The first practical step is for these teams to identify all instances of the affected plugin, determine if they are exposed externally or house critical data, and then assess the risk to prioritize remediation efforts.

Application and platform teams own this.
Verify plugin exposure and critical data.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Grav API plugin?

The Grav API plugin is a software component designed for the Grav content management system, which is a flat-file web platform. It enables the CMS to communicate with external applications and services via an API. Developers typically use this plugin to integrate Grav with other digital tools, allowing those systems to programmatically fetch or manage content and administrative data stored within the website.

What does CWE-862 mean for CVE-2026-75835?

CWE-862 refers to a missing authorization vulnerability. In this specific case, the Grav API plugin fails to check if an API key actually has the correct permissions to perform a requested action. Instead of verifying the key's specific scope, the system incorrectly trusts the account's broader administrative status. This allows someone with a restricted key to bypass those limits and view internal UI metadata that should have been off-limits.

How is this vulnerability triggered?

An attacker must already possess an authenticated, scoped API key to trigger this bug. When they make a request, the `userPassesAuthorize()` function incorrectly grants access by ignoring the key's defined limitations. It is important to note that this does not allow an unauthenticated user to enter the system; the attack specifically relies on using an existing, albeit restricted, key to perform unauthorized actions beyond its intended scope.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates this vulnerability is likely relevant to public-facing environments. Because the Grav API plugin is designed to connect the CMS to external services, it is frequently deployed on web applications accessible over the internet. If your Grav instance hosts an API exposed to the public, the risk is higher, as an attacker could potentially attempt to misuse scoped keys from outside your network.

How should I respond to this vulnerability?

The first step is to audit your Grav installation to identify if the API plugin is in use. Determine which instances are exposed to external traffic or handle sensitive data. Once identified, evaluate the necessity of those API endpoints and prioritize updating the plugin to a version that properly enforces scope restrictions. Coordinate with your platform teams to ensure that existing API keys are reviewed and that access policies are strictly enforced.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.