Main Vulnerability Database Exploits ID:12808 - Exploit for Missing Authorization in Grav CMS - CVE-2026-64852

ID:12808 - Exploit for Missing Authorization in Grav CMS - CVE-2026-64852

Published: July 8, 2026

Vulnerability identifier: #VU137080

Vulnerability risk: Low

CVE-ID: CVE-2026-64852

CWE-ID: CWE-862

Exploitation vector: Remote access

Vulnerable software:
Grav CMS

Link to public exploit:

The vulnerability allows a remote user to bypass authorization checks.

The vulnerability exists due to missing authorization on API-key generate/revoke. A remote administrator can user forge keys for any account.

Install updates from vendor's website.