Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: getgrav grav 1.0.6 Clear all filters
TI-2026-44456 CVE-2026-62233 · GHSA-qrm9-ppgh-qwm9

grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey

Priority MEDIUM 40

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00442 Published 2026-07-17 Fixed in 1.0.6 CWE-639
TI-2026-44454 CVE-2026-62231 · GHSA-q7w3-h9x7-95x7

Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator

Priority HIGH 72

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.0028 Published 2026-07-17 Fixed in 1.0.6 CWE-863