CVE-2026-62666

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.6

Description UsersController functions createApiKey(), generate2fa(), and disable2fa() fail to perform the accessGrantsSuper() target check. An account with api.users.write permissions can use requireApiKeyPermission() to create an API key linked to an access.api.super target. Because key scopes are not enforced, the attacker can obtain full super-administrator privileges and establish persistent access. Additionally, this flaw allows the rotation or disabling of two-factor authentication for the target account.

Recommendations Update Grav API Plugin to version 1.0.6.