Description

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks isSuperAdmin() and returns early before invoking requirePermission(), so the api_key_scopes cap (enforced only in requirePermission()) is skipped. As a result, any scoped API key minted on a super account can bypass its scope restrictions when calling the baseline() and reset() operations (e.g. POST /api/v1/demo/reset), allowing it to capture the demo baseline or force a demo reset. Impact is bounded to demo-engine control and is conditional on demo mode being configured with writable resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-14T12:16:45.397Z",
  "pubdate": "2026-08-14T12:16:45.397Z",
  "executiveSummary": "An API-key scope cap bypass vulnerability exists in the Grav API plugin (getgrav/grav-plugin-api) prior to version 1.0.13.\nThe flaw resides within the DemoController component, specifically in the access control logic of the private requireSuper() method.\nWhen invoked, requireSuper() performs an early return after checking isSuperAdmin(), entirely bypassing the subsequent requirePermission() method where the api_key_scopes capability is normally enforced.\nConsequently, any scoped API key minted on a super account can successfully circumvent its intended scope restrictions when interacting with the baseline() and reset() operations.\nThis enables unauthorized execution of sensitive endpoints such as POST /api/v1/demo/reset.\nThe operational impact is strictly bounded to demo-engine control, allowing threat actors to capture the demo baseline or forcibly trigger a demo reset.\nExploitation of this vulnerability is strictly conditional upon the target system having demo mode configured alongside writable resources.\nThe attack capability requires a validly minted scoped API key associated with a super account to successfully bypass intended permission boundaries.",
  "technicalDetails": "The vulnerability is rooted in flawed authentication and authorization logic within the DemoController class of the Grav API plugin (getgrav/grav-plugin-api) across affected versions prior to 1.0.13.\nThe vulnerable component relies on a private method named requireSuper() to govern access to sensitive administrative functionality.\nDuring execution, requireSuper() evaluates the isSuperAdmin() condition and returns early before ever invoking requirePermission().\nBecause the api_key_scopes capability enforcement mechanism is exclusively bound inside requirePermission(), the early return completely bypasses the validation of api_key_scopes.\nAs a result, API keys minted on a super account that carry restrictive scoping parameters are incorrectly permitted to access operations meant to be restricted.\nThe attack flow proceeds when an authenticated entity issues requests to baseline() or reset() operations, such as sending a POST request to /api/v1/demo/reset.\nDespite the API key lacking the requisite granular scopes, the bypassed authorization checks grant full execution rights.\nThe post-exploitation impact is limited by design to the scope of the demo-engine, enabling attackers to capture the demo baseline state or force an unauthorized demo reset.\nPrerequisites for a successful attack include network exposure of the Grav API endpoints, availability of a scoped API key minted on a super account, and a system configuration where demo mode is actively enabled with writable resources."
}