CyberRota Analysis
AI-GeneratedThe Grav API Plugin prior to version 1.0.8 is vulnerable, allowing basic panel users to exploit the apiKeyGenerate and apiKeyRevoke functions to create persistent API keys that inherit permissions from other accounts, potentially granting unauthorized administrative access. This poses a significant risk as it could lead to unauthorized data manipulation or exposure. Organizations using Grav CMS should prioritize updating to version 1.0.8 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.