https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 21:04:01 +0000 https://cve.radiocsirt.org/vuln/cve-2026-75832 <p><strong>Affected:</strong> getgrav grav</p> <p>The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/&lt;name&gt; scope on the account&#39;s raw super-admin ACL flag (access.api.super) instead of validating the presented API key&#39;s actual scope. An attacker holding an API key scoped only to api.media.write minted on a super-admin account can bypass the authorization check and, via POST /blueprint-upload or GET /blueprint-files, write a file into another user&#39;s scope (in the shared user/accounts/ directory, constrained to image extensions by assertSafeExtension()) and browse that scope&#39;s file listing, despite the key not being granted api.users.write.</p> <p><strong>Affected:</strong> getgrav grav</p> <p>The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/&lt;name&gt; scope on the account&#39;s raw super-admin ACL flag (access.api.super) instead of validating the presented API key&#39;s actual scope. An attacker holding an API key scoped only to api.media.write minted on a super-admin account can bypass the authorization check and, via POST /blueprint-upload or GET /blueprint-files, write a file into another user&#39;s scope (in the shared user/accounts/ directory, constrained to image extensions by assertSafeExtension()) and browse that scope&#39;s file listing, despite the key not being granted api.users.write.</p> https://cve.radiocsirt.org/vuln/cve-2026-75832