CVE-2026-65007 -- CVSS 9.6 Vulnerability Briefing

CVE-2026-65007 | CVSS 9.6 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-65007 is an authorization flaw in the Grav API plugin, grav-plugin-api, before version 1.0.8 that affects the administrative API key generation and revocation task handlers.

Technical Detail

The plugin does not properly enforce authorization when processing the apiKeyGenerate and apiKeyRevoke admin tasks. An attacker able to reach and invoke these administrative task handlers may be able to generate API keys without the intended permissions or revoke existing keys. Successful exploitation could enable unauthorized API access, privilege escalation depending on the generated key's privileges, or disruption of API-dependent administration through key revocation.

Exploitation Status

No known exploit has been reported as of July 28, 2026. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, and active exploitation has not been confirmed.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Upgrade grav-plugin-api to version 1.0.8 or later as a priority. Until patching is complete, restrict access to Grav administrative interfaces to trusted administrators and limit network exposure of admin endpoints. Review API key inventories and administrative logs for unexpected apiKeyGenerate or apiKeyRevoke activity, investigate recently created or revoked keys, and rotate affected API credentials where unauthorized changes are suspected.