CyberRota Analysis
AI-GeneratedThe grav-plugin-api prior to version 1.0.20 is vulnerable due to inadequate validation of group-inherited super permissions, allowing non-super user managers to alter super-admin accounts. This flaw enables attackers with specific API access rights to modify password fields, potentially granting them full administrative control over the system. Organizations utilizing this plugin should prioritize patching to mitigate the risk of unauthorized access and administrative takeover.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.