CVE-2026-75832

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.15

Description An authorization bypass exists in the BlueprintPathResolver::resolveUserScope() function. The system checks the account's super-admin ACL flag access.api.super instead of validating the actual scope of the provided API key. An attacker with an API key scoped only to api.media.write created from a super-admin account can bypass authorization. This allows the attacker to use the 'POST /blueprint-upload' or 'GET /blueprint-files' endpoints to write files into another user's scope within the shared user/accounts/ directory (limited to image extensions by assertSafeExtension()) and browse that scope's file listing, even without the api.users.write permission.

Recommendations Update Grav API plugin to version 1.0.15.