CyberRota Analysis
AI-GeneratedThe Grav API plugin prior to version 1.0.6 is vulnerable to an authorization bypass, allowing API keys with restricted scopes to perform unrestricted operations, including write and administrative actions. This flaw poses a significant risk to any application using the plugin, as it undermines the intended access controls. Organizations utilizing this plugin should prioritize upgrading to version 1.0.6 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created with limited scopes (e.g. read-only) can perform any write, delete, or administrative operation the owning user is authorized for. Fixed in 1.0.6.