Description

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the owning user's complete identity. AbstractApiController::requirePermission() consequently evaluates the full user ACL, so a key issued for a read-only scope can perform every write, delete, and administrative operation available to the owner. This issue is fixed in version 1.0.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T16:18:19.177Z",
  "pubdate": "2026-08-19T16:18:19.177Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the Grav API Plugin for Grav CMS prior to version 1.0.6. The vulnerability stems from improper handling of API key scopes during the authentication and access control evaluation phases.\nSpecifically, while the ApiKeyManager::generateKey() function correctly stores a declared scopes array when issuing an API key, the ApiKeyAuthenticator::authenticate() function fails to read the keyData[scopes] parameter. Instead, it returns the complete identity of the user who owns the API key.\nConsequently, when AbstractApiController::requirePermission() evaluates the request, it inspects the full Access Control List (ACL) of the owning user rather than restricting permissions to the scopes explicitly assigned to the API key.\nThis flaw allows an attacker possessing an API key restricted to read-only scopes to execute unauthorized write, delete, and administrative operations that should otherwise be prohibited. The impact includes full administrative compromise of the affected Grav CMS instance via headless RESTful API access.\nExploitation requires a valid API key issued with limited scopes, which can then be abused to perform out-of-scope actions against the RESTful API endpoints.",
  "technicalDetails": "The vulnerability resides in the authorization and API key handling mechanisms of the Grav API Plugin. The affected components include ApiKeyManager::generateKey(), ApiKeyAuthenticator::authenticate(), and AbstractApiController::requirePermission() across versions prior to 1.0.6.\nThe root cause of the vulnerability is a discrepancy between key generation and key authentication logic. During the API key creation process, the ApiKeyManager::generateKey() method properly accepts and stores a declared scopes array associated with the generated key data. However, the authentication routine implemented in ApiKeyAuthenticator::authenticate() fails to parse, evaluate, or enforce the keyData[scopes] parameter present in the stored key data structure.\nUpon successful lookup of an API key, ApiKeyAuthenticator::authenticate() bypasses scope validation entirely and returns the complete user identity object belonging to the owner of the API key. This behavior effectively elevates the privilege context of the API request from the intended scoped limitations to the full administrative or standard privileges of the owning user account.\nThe step-by-step attack flow proceeds as follows: First, an API key is issued with restricted, read-only permissions intended for minimal data retrieval. Second, an authenticated attacker or an adversarial entity utilizing this scoped API key sends a Hypertext Transfer Protocol (HTTP) request to perform a restricted action, such as a write or delete operation through the RESTful API endpoints. Third, the request hits AbstractApiController::requirePermission(), which evaluates the permission requirements against the user identity returned by the authentication layer. Because the authentication layer returned the complete user identity rather than the scoped subset, the permission check evaluates the full user ACL. Finally, the restricted write, delete, or administrative operation is permitted and executed successfully by the application.\nNetwork exposure is defined by the availability of the Grav API Plugin RESTful endpoints. Authentication is required in the form of a valid API key, but due to the bypass, low-privilege or scoped authentication credentials are sufficient to achieve high-privilege post-exploitation impact, including complete data modification and administrative control over the headless CMS content."
}