Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-75832, is a missing authorization flaw in the Grav API plugin. The core issue resides in BlueprintPathResolver::resolveUserScope(), which incorrectly gates access to user scopes based on a raw access.api.super flag of the account, rather than validating the specific scope granted to the API key being used. This means an API key with a narrow scope (e.g., api.media.write) can gain elevated privileges (e.g., api.users.write) if it was generated by a super-admin account. The BlueprintUploadController::upload() and BlueprintFilesController::list() functions are the direct entry points that trigger this vulnerable logic. They call the BlueprintPathResolver::resolve() method without passing the crucial API key scope information, leading to the authorization bypass. The fix involves modifying these functions to pass a $callerIsSuperWithinScope parameter to the resolver, ensuring that the API key's actual scope is considered during authorization.
