CVE-2026-75836

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.14

Description The Grav API plugin fails to enforce authorization requirements within the MenubarController::executeAction() function. While the 'GET /menubar/items' endpoint correctly filters items, the 'POST /api/v1/menubar/actions/{plugin}/{action}' endpoint only verifies the basic api.access permission and ignores the authorize field registered by a plugin for that action. Consequently, any authenticated user with api.access can execute privileged menubar actions, bypassing intended authorization. This issue affects first- or third-party plugins that rely on documented authorize semantics.

Recommendations Update to version 1.0.14 or later.