CVE-2026-62231

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.6

Description An authorization bypass exists because the ApiKeyAuthenticator class fails to read or enforce the restricted scopes array when API keys are created. Consequently, a key intended for limited access, such as read-only, can be used to perform any write, delete, or administrative operation that the owning user is authorized to execute, as the system returns the full account object of the user.

Recommendations Update Grav API plugin to version 1.0.6.