External risk intelligence

Grav API Plugin Scope Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-80204

This vulnerability affects an API plugin for Grav, a web-based Content Management System. API endpoints for CMS platforms are commonly exposed to the internet to facilitate remote content management, integrations, and automated workflows, making this a frequently internet-facing component in standard web deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Grav API plugin could allow unauthorized access to page security settings. This means a user with a limited API key might be able to view or modify permissions beyond what they are authorized for, potentially impacting data access controls. While the full extent of the write-time impact was not confirmed, this warrants attention for any organization using this plugin.

Unauthorized API key use is possible.
Affects API access to content permissions.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could interact with the Grav API plugin's security settings by sending specially crafted requests. This could allow them to view or modify page permissions beyond what their API key normally permits, potentially leading to unauthorized access or changes within the system.

No authentication required.
Accessing sensitive blueprint sections.
Unauthorized modification of page permissions.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker with a scoped API key to access and potentially modify page permission settings that exceed the key's authorized scope. This occurs when the API plugin fails to correctly enforce these scope limitations during certain administrative operations. The specific impact on write operations was not fully confirmed.

Page permission settings could be at risk.
Exposure may happen via a scoped API key.
Unauthorized access to sensitive settings could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Grav API plugin may allow unauthorized access to page permissions if an attacker holds a scoped API key. The first practical step is to identify all instances of the Grav API plugin, determine their internet reachability and business criticality, and then identify the specific teams or individuals accountable for these deployments. Once ownership is confirmed, a risk-based remediation plan can be developed, potentially involving vendor coordination or temporary risk reduction measures if immediate patching is not feasible or the impact is not fully understood.

Application owners and platform teams.
Confirm API plugin reachability and criticality.
Plan remediation based on confirmed ownership.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Grav API plugin?

The Grav API plugin is an extension for Grav, which is a flat-file content management system. It enables developers and automated tools to interact with the CMS remotely, facilitating tasks like content updates and site management without needing the standard web interface. By design, this plugin allows external applications to programmatically control site data and settings.

How does CWE-863 apply to CVE-2026-80204?

This vulnerability is classified as CWE-863, which refers to Incorrect Authorization. In this specific case, the plugin fails to verify that an API key has the necessary privileges before granting access to sensitive settings. Because the logic checks for general administrator status rather than confirming the key's specific scope, it grants permissions to unauthorized users, effectively bypassing the security controls meant to limit what an API key can do.

Do I need to be a superuser to trigger this vulnerability?

No, you do not need administrative rights to trigger the bug. The issue stems from the API plugin itself failing to enforce scope restrictions. While a scoped API key is required to initiate the request, the vulnerability allows that key to exceed its intended limits. Conversely, this does not apply to standard user interactions that do not utilize the Grav API plugin or to requests that are correctly validated by other parts of the system.

Is my Grav instance likely to be reachable from the internet?

Halo Surface Signal notes that API endpoints for CMS platforms are often exposed to the internet to support integrations and automated workflows. Because this plugin is frequently used in such deployments, your specific instance is more likely to be reachable by external actors if it handles remote content management. You should verify if your API endpoints are accessible publicly or restricted to internal networks.

What is the first step to address CVE-2026-80204?

Begin by auditing your environment to identify every server running the Grav API plugin. Once you have a complete inventory, determine which instances are exposed to the internet versus those kept on private networks. Assign ownership to the relevant teams and prioritize updates based on the criticality of the site. If you cannot update immediately, evaluate if you can restrict API access to trusted IP addresses as a temporary defensive measure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.