Grav Plugin API: Two Critical, One High Vulnerability Disclosed Together
Key findings • Two Critical and one High severity vulnerabilities disclosed for Grav Plugin API and Login plugin. • CVE-2026-80203 bypasses API-key scope enforcement on user management endpoi…
Key findings
- Two Critical and one High severity vulnerabilities disclosed for Grav Plugin API and Login plugin.
- CVE-2026-80203 bypasses API-key scope enforcement on user management endpoints.
- CVE-2026-56710 allows attackers to clear brute-force protection on admin accounts.
- CVE-2026-72700 uses insecure string comparison for password reset tokens.
- Patched versions are Grav Plugin API 1.0.18 and Login plugin 3.9.1.
On August 26, 2026, a batch of three vulnerabilities was disclosed for the Grav Plugin API, with two rated Critical and one High. The vulnerabilities, affecting the getgrav/grav-plugin-api and getgrav/grav-plugin-login components, were disclosed between August 25th and 26th, 2026. These flaws could allow attackers to bypass API key scope restrictions, compromise password reset mechanisms, and disable brute-force protection on high-privilege accounts.
One critical vulnerability (CVE-2026-80203) in the getgrav/grav-plugin-api plugin, specifically in the requireNotSuperTarget() function within UsersController.php, fails to enforce API-key scope. This oversight affects seven sensitive user-management endpoints, as the check incorrectly uses isSuperAdmin() on the acting account instead of verifying the API key's actual super authority.
Another critical vulnerability (CVE-2026-56710) impacts the Grav Login plugin (versions before 1.0.16). The onApiUserListRowAction unlock handler fails to validate the target account's privilege level. An attacker with 'api.users.write' permission can exploit this to clear login lockout counters for 'admin.super' accounts, effectively removing brute-force protection for the most privileged accounts without requiring super administrator privileges. This was also noted in related reporting by Vypr Intelligence.
A high severity vulnerability (CVE-2026-72700) exists in the getgrav/grav-plugin-login Composer plugin (versions before 3.9.1). It compares password reset and account activation tokens using a non-constant-time '===' string comparison instead of the more secure hash_equals() function. This occurs in classes/Controller.php (taskReset()) and the login.php activation handler, potentially allowing token leakage or manipulation.
The disclosed vulnerabilities were addressed in updated versions of the affected plugins. Specifically, the getgrav/grav-plugin-api was patched in version 1.0.18, and the getgrav/grav-plugin-login was fixed in version 3.9.1. Users are strongly advised to update to these versions to mitigate the risks associated with these security flaws.
These vulnerabilities highlight the importance of rigorous access control and secure comparison methods in API and authentication components. Users of the Grav Plugin API and Grav CMS should ensure their systems are updated promptly to prevent potential account takeovers and unauthorized access.
CVE-2026-80203: The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority.
CVE-2026-56710: Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without r
CVE-2026-72700: The getgrav/grav-plugin-login Composer plugin before 3.9.1 compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because the token-submission endpoint (task
The Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without r. This vulnerability was also noted in related reporting by Vypr Intelligence.
The getgrav/grav-plugin-login Composer plugin before 3.9.1 compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because the token-submission endpoint (task. This vulnerability was also noted in related reporting by Vypr Intelligence.
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority. This vulnerability was also noted in related reporting by Vypr Intelligence.
The Grav Plugin API and Grav CMS should ensure their systems are updated promptly to prevent potential account takeovers and unauthorized access. The getgrav/grav-plugin-api was patched in version 1.0.18, and the getgrav/grav-plugin-login was fixed in version 3.9.1. Users are strongly advised to update to these versions to mitigate the risks associated with these security flaws.
The Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without r. This vulnerability was also noted in related reporting by Vypr Intelligence.
The getgrav/grav-plugin-login Composer plugin before 3.9.1 compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because the token-submission endpoint (task. This vulnerability was also noted in related reporting by Vypr Intelligence.
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority. This vulnerability was also noted in related reporting by Vypr Intelligence.
The Grav Plugin API and Grav CMS should ensure their systems are updated promptly to prevent potential account takeovers and unauthorized access. The getgrav/grav-plugin-api was patched in version 1.0.18, and the getgrav/grav-plugin-login was fixed in version 3.9.1. Users are strongly advised to update to these versions to mitigate the risks associated with these security flaws.