CyberRota Analysis
AI-GeneratedVersions of grav-plugin-api prior to 1.0.20 are vulnerable to a privilege escalation flaw in the InvitationsController, allowing non-super users with specific permissions to create invitations that include dot-keyed super flags, thereby bypassing access controls. This vulnerability enables attackers to establish super-admin accounts through public endpoints, granting them full control over the site via valid JWTs. Organizations utilizing affected versions should prioritize patching to mitigate the risk of unauthorized access and potential site compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write permissions can create an invitation with a dot-keyed super flag in the access payload that bypasses the guard and persists to the new account. Attackers can accept the invitation through the public endpoint without real invitee interaction to create a super-admin account and immediately receive a valid JWT for full site control.