CyberRota Analysis
AI-GeneratedThe Grav API Plugin prior to version 1.0.6 is vulnerable due to insufficient access control in the UsersController, allowing non-super accounts with write permissions to create API keys that grant super-administrator privileges. This can lead to unauthorized access and control over the site, including the ability to manage two-factor authentication settings. Organizations using Grav CMS with this plugin should prioritize updating to version 1.0.6 to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApiKeyPermission(), obtain the target's full privileges because key scopes are not enforced, and create persistent super-administrator access; the same missing check also permits rotating or disabling the target's two-factor authentication. This issue is fixed in version 1.0.6.