CVE WatchJul 23, 2026

CVE-2026-65007

The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the

CVSS

9.6

Critical

EPSS

0.4%

p31

KEV

—

Exploit Today

0-100

Published: Jul 21, 2026 · Last modified: Jul 23, 2026 · CWE-862

EPSS · 30d

0.3%EPSS · 30 days0.4%

2026-08-202026-09-18

Technical description

The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-546766.5 MED

15.9%

——5Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies() does not apply canAccessSpace before returning data from GET /api/posts/{id}/answers. The issue is reachable when scoold.api_user_access_enabled and scoold.api_enabled are true and a token holder knows or enumerates a private question identifier. Under those conditions, the question endpoint can deny access while the answers endpoint returns the private reply bodies, exposing confidential team or project discussions. This issue is fixed in version 1.69.0.5h CVE-2026-785285.3 MED

12.1%

——4Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.23h CVE-2026-740175.3 MED

13.8%

——4Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.23h CVE-2026-740025.3 MED

12.1%

——4Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.23h CVE-2026-740005.3 MED

12.1%

——4Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.23h CVE-2026-666765.3 MED

13.8%

——4Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.23h