Description

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApiKeyPermission(), obtain the target's full privileges because key scopes are not enforced, and create persistent super-administrator access; the same missing check also permits rotating or disabling the target's two-factor authentication. This issue is fixed in version 1.0.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T16:18:19.043Z",
  "pubdate": "2026-08-19T16:18:19.043Z",
  "executiveSummary": "An access control vulnerability exists in the Grav API Plugin for Grav CMS prior to version 1.0.6, specifically within the UsersController::createApiKey(), generate2fa(), and disable2fa() methods. The vulnerability arises due to the omission of the accessGrantsSuper() target check that is properly enforced in sibling user mutation endpoints. This flaw allows a non-super-administrator account possessing the api.users.write permission to exploit the authorization gap. By leveraging requireApiKeyPermission(), an attacker can successfully mint an API key bound to an access.api.super target. Because API key scopes are not enforced during subsequent requests, the generated key inherits the target's full administrative privileges, allowing the attacker to establish persistent super-administrator access. Additionally, the missing access check permits unauthorized manipulation of two-factor authentication, including rotating or disabling 2FA for the target account. The risk implications are severe, as low-privileged users can completely compromise the integrity and confidentiality of the affected CMS instance by escalating to full administrative control. Exploitation requires authenticated access with the api.users.write permission and targets systems running unpatched versions of the Grav API Plugin prior to 1.0.6.",
  "technicalDetails": "The vulnerability is rooted in inadequate access control enforcement within the Grav API Plugin prior to version 1.0.6. The affected components are the UsersController::createApiKey(), generate2fa(), and disable2fa() methods. Unlike sibling user mutation endpoints within the API controller that correctly implement the accessGrantsSuper() target check to restrict administrative privilege modifications, these specific methods fail to validate whether the executing user possesses the necessary administrative jurisdiction to alter super-level accounts or assign super-level privileges.\nThe attack flow proceeds as follows. An attacker with a non-super-administrator account that has been granted the api.users.write permission interacts with the vulnerable RESTful endpoints provided by the Grav API Plugin. Because UsersController::createApiKey() lacks the proper accessGrantsSuper() validation, the attacker can request the generation of a new API key targeting an elevated context via requireApiKeyPermission(). The system honors the request and mints an API key bound to an access.api.super target without validating the requester's actual administrative standing.\nFollowing the successful creation of the malicious API key, the attacker utilizes the generated token for subsequent API requests. Due to the lack of runtime scope enforcement for API keys within the plugin, the key fails to restrict operations and instead operates with the full privileges of the bound target. This enables the attacker to obtain full super-administrator privileges and execute privileged administrative functions, effectively achieving privilege escalation and creating persistent super-administrator access.\nFurthermore, the absence of the accessGrantsSuper() check in the generate2fa() and disable2fa() methods allows the same class of authenticated attacker to arbitrarily rotate or disable two-factor authentication mechanisms for targeted user accounts, compromising account security and facilitating further persistence or takeover. The vulnerability affects network-exposed RESTful API interfaces of Grav CMS installations running vulnerable versions of the Grav API Plugin prior to 1.0.6, requiring prior authentication with specific API write permissions but circumventing intended hierarchical permission boundaries."
}