CVE-2026-65007

Name of the Vulnerable Software and Affected Versions grav-plugin-api versions prior to 1.0.8

Description The plugin fails to properly authorize API key generation and revocation. It intercepts the apiKeyGenerate and apiKeyRevoke admin tasks before the account-management Access Control List (ACL) runs, authorizing the caller based only on the admin.login permission, which is the baseline permission for every panel user. This allows any user with admin.login to create a persistent API key bound to any account. The forged key inherits the API permissions of the target account, potentially leading to account impersonation and privilege escalation up to full account takeover if the target account has broader permissions.

Recommendations Update grav-plugin-api to version 1.0.8 or later.