CVE-2026-75832

Descrição

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/<name> scope on the account-s raw super-admin ACL flag (access.api.super) instead of validating the presented API key-s actual scope. An attacker holding an API key scoped only to api.media.write minted on a super-admin account can bypass the authorization check and, via POST /blueprint-upload or GET /blueprint-files, write a file into another user-s scope (in the shared user/accounts/ directory, constrained to image extensions by assertSafeExtension()) and browse that scope-s file listing, despite the key not being granted api.users.write.