---
id: CVE-2026-75832
title: >-
  The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before
  version 1.0.14 (fixed in 1.0.15) contains a missing authorization
  vulnerability in BlueprintPathResolver::resolveUserScope()
summary: >-
  The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before
  version 1.0.14 (fixed in 1.0.15) contains a missing authorization
  vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates
  the users/<name> s…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
published: '2026-08-18'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:32:39.347'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75832'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-435x-66r2-jwv2'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/grav-api-plugin-before-authorization-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00222
epssPercentile: 0.12992
ingestedAt: '2026-09-08T21:11:12.279Z'
---

## Overview

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/<name> scope on the account's raw super-admin ACL flag (access.api.super) instead of validating the presented API key's actual scope. An attacker holding an API key scoped only to api.media.write minted on a super-admin account can bypass the authorization check and, via POST /blueprint-upload or GET /blueprint-files, write a file into another user's scope (in the shared user/accounts/ directory, constrained to image extensions by assertSafeExtension()) and browse that scope's file listing, despite the key not being granted api.users.write.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.