CyberRota Analysis
AI-GeneratedGrav-plugin-api versions prior to 1.0.6 are vulnerable due to inadequate validation of super-admin status in critical endpoints, enabling non-super admin users to escalate their privileges. This flaw allows attackers to generate API keys with super-admin access or disable 2FA for super-admin accounts, potentially leading to complete control over the instance. Organizations using this plugin should prioritize immediate updates to mitigate the risk of unauthorized access and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achieve full instance takeover.