https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:21:05 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-75832 <p>The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/&lt;name&gt; scope on the account&#39;s raw super-admin ACL flag (access.api.super) instead of validating the presented API key&#39;s actual scope. An attacker holding an API key scoped only to api.media.write minted on a super-admin account can bypass the authorization check and, via POST /blueprint-upload or GET /blueprint-files, write a file into another user&#39;s scope (in the shared user/accounts/ directory, constrained to image extensions by assertSafeExtension()) and browse that scope&#39;s file listing, despite the key not being granted api.users.write.</p> <p>The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/&lt;name&gt; scope on the account&#39;s raw super-admin ACL flag (access.api.super) instead of validating the presented API key&#39;s actual scope. An attacker holding an API key scoped only to api.media.write minted on a super-admin account can bypass the authorization check and, via POST /blueprint-upload or GET /blueprint-files, write a file into another user&#39;s scope (in the shared user/accounts/ directory, constrained to image extensions by assertSafeExtension()) and browse that scope&#39;s file listing, despite the key not being granted api.users.write.</p> https://db.gcve.eu/vuln/fkie_cve-2026-75832 https://db.gcve.eu/vuln/ghsa-xgr3-7x2w-f8vc <p>The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/&lt;name&gt; scope on the account&#39;s raw super-admin ACL flag (access.api.super) instead of validating the presented API key&#39;s actual scope. An attacker holding an API key scoped only to api.media.write minted on a super-admin account can bypass the authorization check and, via POST /blueprint-upload or GET /blueprint-files, write a file into another user&#39;s scope (in the shared user/accounts/ directory, constrained to image extensions by assertSafeExtension()) and browse that scope&#39;s file listing, despite the key not being granted api.users.write.</p> <p>The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/&lt;name&gt; scope on the account&#39;s raw super-admin ACL flag (access.api.super) instead of validating the presented API key&#39;s actual scope. An attacker holding an API key scoped only to api.media.write minted on a super-admin account can bypass the authorization check and, via POST /blueprint-upload or GET /blueprint-files, write a file into another user&#39;s scope (in the shared user/accounts/ directory, constrained to image extensions by assertSafeExtension()) and browse that scope&#39;s file listing, despite the key not being granted api.users.write.</p> https://db.gcve.eu/vuln/ghsa-xgr3-7x2w-f8vc