Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
🚨 CVE-2026-65007 — CVSS 9.6/10 ██████████ The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/gfbGwC3od3
Post summary
A critical vulnerability (CVE-2026-65007) in the Grav API plugin (before 1.0.8) negates proper authorization for API key operations; a patch is now available.
🚨 CRITICAL: CVE-2026-65007 (CVSS 9.6) Grav API plugin <1.0.8 allows any authenticated user to generate API keys for ANY account, enabling privilege escalation to account takeover. Patch immediately! #CVE #PatchNow https://t.co/Rx3xvqrK7i
Post summary
A critical vulnerability (CVE-2026-65007) in Grav API plugin allows authenticated users to generate API keys for any account, enabling privilege escalation; patch immediately is required.