CVE-2026-75835

Name of the Vulnerable Software and Affected Versions Grav API plugin (getgrav/grav-plugin-api) versions prior to 1.0.14

Description An issue exists in the userPassesAuthorize() function within AbstractApiController.php where the system fails to verify the API key scopes of the calling request. Instead, it relies on the account's raw super-admin flag and Access Control List (ACL) grants. This allows an authenticated attacker using a scoped API key from a privileged account to bypass scope restrictions and access protected UI metadata and item definitions, such as sidebar, menubar, and widget items, as well as users-list columns, row-actions, and filter-tabs, leading to information disclosure.

Recommendations Update Grav API plugin (getgrav/grav-plugin-api) to version 1.0.14 or later.