CyberRota Analysis
AI-GeneratedThe Grav API plugin versions 1.0.6 to 1.0.11 are vulnerable to a privilege escalation issue that allows a read-only API key to perform unauthorized write operations on critical endpoints, effectively granting super-admin privileges to any account. This vulnerability arises from a failure to enforce scope restrictions, enabling attackers to manipulate access control lists and escalate privileges. Organizations using this plugin, particularly those managing sensitive data or user permissions, should prioritize upgrading to version 1.0.13 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin()-gated write endpoints (in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController). These endpoints authorize via a super-admin early-return that never invokes requirePermission()—the sole enforcement point of the scope cap—so a 'read-only'-scoped key (e.g. api.pages.read) can perform super-only write operations, including rewriting group ACL maps to grant super-admin privileges to arbitrary accounts. A leaked or delegated read-only CI/monitoring key can therefore gain full super-admin write capability. Fixed in 1.0.13.