CyberRota Analysis
AI-GeneratedThe Grav API Plugin prior to version 1.0.6 contains a vulnerability that allows an API key with read-only permissions to perform unauthorized write, delete, and administrative operations due to improper handling of user scopes. This flaw could lead to significant security breaches, as it exposes sensitive actions to users who should only have limited access. Organizations using the Grav CMS should prioritize updating to version 1.0.6 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the owning user's complete identity. AbstractApiController::requirePermission() consequently evaluates the full user ACL, so a key issued for a read-only scope can perform every write, delete, and administrative operation available to the owner. This issue is fixed in version 1.0.6.