CVE-2026-80204

Name of the Vulnerable Software and Affected Versions Grav API plugin (getgrav/grav-plugin-api) versions prior to 1.0.18

Description The injectSecurityTab() function within the BlueprintController fails to apply the API-key scope cap when determining if a page's security or permissions blueprint section is editable. The function executes isSuperAdmin() and hasPermission() checks without a request parameter, which prevents the enforcement of scopeAllows(). Consequently, a user with a scoped API key can view and potentially modify page permission fields that exceed the permissions granted to that key.

Recommendations Update Grav API plugin (getgrav/grav-plugin-api) to version 1.0.18 or later.