What is GHSA-jqh9-6gqv-p52m?

GHSA-jqh9-6gqv-p52m is a security advisory published by GitHub Security Advisories with Critical severity. The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the...

Which CVE IDs does GHSA-jqh9-6gqv-p52m cover?

GHSA-jqh9-6gqv-p52m covers the following CVE IDs: CVE-2026-80203. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jqh9-6gqv-p52m?

GHSA-jqh9-6gqv-p52m has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-jqh9-6gqv-p52mCriticalCVSS 9.8

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the...

Vendor

GitHub Security Advisories

Published

August 29, 2026

Last Modified

August 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-80203 →

📋 Description

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.

🔗 References (4)

https://github.com/getgrav/grav/security/advisories/GHSA-94q7-vrqr-cx5v
https://nvd.nist.gov/vuln/detail/CVE-2026-80203
https://www.vulncheck.com/advisories/grav-before-1.0.18-authentication-bypass-via-scoped-api-key
https://github.com/advisories/GHSA-jqh9-6gqv-p52m