CVE-2026-62667

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.6

Description An issue exists where the ApiKeyManager::generateKey() function stores a declared scopes array, but the ApiKeyAuthenticator::authenticate() function fails to read the keyData[scopes] variable and instead returns the complete identity of the owning user. As a result, the AbstractApiController::requirePermission() function evaluates the full Access Control List (ACL) of the user. This allows a key issued with a read-only scope to perform any write, delete, or administrative operation available to the owner.

Recommendations Update Grav API Plugin to version 1.0.6.