Grav api Plugin Vulnerability: Potential Account Takeover Risk
An early warning has been issued regarding a critical vulnerability in the Grav api plugin (grav-plugin-api) before version 1.0.8, which reportedly allows unauthorized API key generation and potential account takeover.
What happened
The Grav api plugin (grav-plugin-api) before version 1.0.8 is under investigation for a critical vulnerability (CVE-2026-65007) that appears to fail to properly authorize API key generation and revocation. This vulnerability reportedly allows any user with the admin.login permission to mint a persistent API key bound to any account. This forged key inherits the target account's API permissions, enabling account impersonation and privilege escalation up to account takeover on systems where an API-enabled account holds broader permissions.
To assess your exposure, check if your system is running a version of grav-plugin-api prior to 1.0.8. If so, it is recommended to upgrade to grav-plugin-api@1.0.8 or later to mitigate the risk of unauthorized API key generation and potential account takeover. For more detailed information, consult the primary sources linked in the threat data.
How 0Day mitigates this
grav-plugin-api is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.