CyberRota Analysis
AI-GeneratedThe Grav Plugin API prior to version 1.0.13 is vulnerable due to improper enforcement of API-key scope caps in the InvitationsController, allowing a least-privilege API key to grant super-admin access when creating invitation records. This flaw can lead to privilege escalation, enabling unauthorized users to gain full control over super accounts. Organizations using this plugin should prioritize patching to mitigate the risk of exploitation and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so a least-privilege API key (scoped to api.users.write) minted on a super account can create an invitation record containing super-admin access flags. When the invitation is accepted, those flags are written verbatim to the new account, resulting in privilege escalation to a fully controlled super account.