CyberRota Analysis
AI-GeneratedThe Grav API plugin prior to version 1.0.14 has a vulnerability in the MenubarController that allows authenticated users with basic API access to bypass authorization checks when invoking privileged actions via the POST /api/v1/menubar/actions endpoint. This could lead to unauthorized access to sensitive functionalities if any plugins are developed that utilize the affected authorization semantics. Developers and administrators using Grav, especially those implementing custom or third-party plugins, should prioritize addressing this vulnerability to prevent potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize(), the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only checks the baseline api.access permission and never evaluates the authorize field a plugin registered for that action. Any authenticated caller with api.access can therefore invoke a privileged menubar action directly, bypassing the intended authorization. No plugin bundled with core Grav currently registers a privileged authorize handler, so on a stock install the impact is latent; the flaw affects any first- or third-party plugin relying on the documented authorize semantics.