EUVD lists API-key scope cap bypass in Grav grav-plugin-api before 1.0.13
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- getgrav
- Product
- grav-plugin-api
- First seen
Summary
The EUVD database entry EUVD-2026-58639 describes an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint of grav-plugin-api before 1.0.13. The entry gives a CVSS v3.1 score of 7.2.
If you use getgrav
Update grav-plugin-api to version 1.0.13 or later
Audit API keys with config write scopes
Review recent calls to the reports allowlist endpoint
Revoke API keys created recently that you did not expect
Review the scopes assigned to existing API keys
What the sources say 2
· Mastodon: “The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey.” Source
· Mastodon: “The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController).” Source