CyberRota Analysis
AI-GeneratedThe Grav API plugin prior to version 1.0.13 is vulnerable due to an API-key scope-cap bypass in the UsersController's create() and update() methods, allowing users with limited api.users.write permissions to escalate their privileges. This flaw permits unauthorized users to gain super-admin access, enabling them to perform unrestricted administrative actions. Organizations using this plugin should prioritize immediate updates to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a result, an api.users.write-scoped key minted on a super account can set access.api.super or assign a super-granting group to mint or promote a full super account, then authenticate as that account for uncapped administrative privileges.