CVE-2026-62231 Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator
Attackers with limited-scope API keys can perform unauthorized write, delete, or administrative actions due to missing scope enforcement in the Grav API plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-62231?
CVE-2026-62231 is a high-severity missing authorization vulnerability in getgrav grav, published on 17 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created with limited scopes (e.g. read-only) can perform any write, delete, or administrative operation the owning user is authorized for. Fixed in 1.0.6.
Weakness: CWE-863
Which versions are affected by CVE-2026-62231?
How do I fix CVE-2026-62231?
No fix has been published for CVE-2026-62231 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-62231 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62231 exists.
Sources
Also known as GHSA-q7w3-h9x7-95x7.