CVE-2026-62666

Description

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site-s content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApiKeyPermission(), obtain the target-s full privileges because key scopes are not enforced, and create persistent super-administrator access; the same missing check also permits rotating or disabling the target-s two-factor authentication. This issue is fixed in version 1.0.6.