CVE-2026-80204

Katalog CVE

CVSS 5.4 · Medium EPSS 0,24%

Kerentanan Incorrect Authorization. Skor CVSS 3.1 5.4 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin()/hasPermission() checks without a request parameter, it cannot enforce scopeAllows(). A caller holding a scoped API key may therefore see (and potentially edit) page permission fields beyond the scope granted to the key. The end-to-end write-time impact was not fully confirmed by the reporter.

Rincian

Terbit di NVD

26 Agustus 2026

Terakhir diubah

3 September 2026

Status NVD

Deferred

CVSS 3.1

5.4 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/getgrav/grav/security/advisories/GHSA-mcx6-4rvg-7r8v
• https://www.vulncheck.com/advisories/grav-before-1.0.18-authentication-bypass-via-scoped-api-key-2