Grav API Plugin Authorization Bypass in Action Endpoints

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize(), the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only checks the baseline api.access permission and never evaluates the authorize field a plugin registered for that action. Any authenticated caller with api.access can therefore invoke a privileged menubar action directly, bypassing the intended authorization. No plugin bundled with core Grav currently registers a privileged authorize handler, so on a stock install the impact is latent; the flaw affects any first- or third-party plugin relying on the documented authorize semantics.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-75836 is an authorization bypass vulnerability in the Grav API plugin that fails to enforce fine-grained permission checks on plugin actions. While the menubar listing endpoint correctly validates user permissions, the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only verifies baseline API access and ignores the authorize field defined by plugins for specific actions. This means any authenticated user—regardless of their intended privilege level—can execute plugin actions they should not have access to. Organizations using Grav with the API plugin before version 1.0.14 are affected, particularly those relying on role-based access controls to restrict administrative capabilities.

Casky's 283 matched skills detect this vulnerability through Claude AI's analysis of privilege escalation patterns (MITRE TA0004) and persistence mechanisms (TA0006). Practitioners using Casky would observe findings highlighting improper authorization enforcement at the API controller level, missing permission validation chains, and inconsistent access control between read and write operations. The extended reasoning capabilities identify the dangerous pattern: attackers with basic API credentials can bypass intended role restrictions by directly invoking plugin actions, enabling lateral movement within administrative functions and potential system compromise. Findings would flag the MenubarController's selective authorization checks and recommend comprehensive permission validation across all API endpoints.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75836.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-75836

Casky has 283 skills that investigate the attack patterns behind CVE-2026-75836. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn