What is CVE-2026-75835?
CVE-2026-75835 is a missing authorization vulnerability in the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.14. The userPassesAuthorize() function fails to validate API key scopes, instead relying on super-admin flags, potentially allowing unauthorized actions. Upgrading to version 1.0.14 or later is recommended.
Azərbaycanca: CVE-2026-75835 Grav API plugin-in 1.0.14-dən əvvəlki versiyalarında müşahidə olunan 'missing authorization' zəifliyidir. userPassesAuthorize() funksiyası API açarının icazə dairələrini yoxlamaq əvəzinə super-admin bayrağına etibar etdiyi üçün icazəsiz əməliyyatlara yol aça bilər. Plugin-i ən azı 1.0.14 versiyasına yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-862; shared vendor: getgrav
FAQ2
Which versions of the Grav API plugin are affected by CVE-2026-75835?
This vulnerability affects the Grav API plugin versions prior to 1.0.14.
What is wrong with the userPassesAuthorize() function in CVE-2026-75835?
The function relies on the super-admin flag instead of checking API key scopes, leading to missing authorization.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.