Description

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super account can submit an empty scopes array to mint an unscoped, full-access super key, bypassing scope restrictions (and enabling further chains such as configuration write to RCE).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-14T12:16:45.780Z",
  "pubdate": "2026-08-14T12:16:45.780Z",
  "executiveSummary": "An improper authorization and missing validation vulnerability exists in the getgrav/grav-plugin-api plugin before version 1.0.13.\nThe vulnerability allows an attacker holding an API key with minimal scopes on a super account to mint an unscoped, full-access super key.\nThis occurs because the createApiKey function fails to validate that the scopes of a newly created API key are a subset of the caller's scopes, trusting the scopes read directly from the request body.\nThe impact includes complete bypass of scope restrictions, enabling severe further exploitation chains such as configuration write resulting in remote code execution (RCE).\nThe risk implication is critical, as low-privileged API key holders can escalate privileges to full administrative capabilities.\nExploitation requires network exposure, authentication via a minimal-scope API key, and submission of a maliciously crafted request body containing an empty or expanded scopes array.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient validation logic within the createApiKey function of the getgrav/grav-plugin-api plugin prior to version 1.0.13.\nSpecifically, the self-target path of the requireApiKeyPermission() function mandates only the baseline api.access scope for execution.\nDuring the API key creation process, the application reads the requested scopes directly from the incoming request body without enforcing a subset check against the privileges held by the calling API key.\nThe attack flow proceeds as follows: an attacker obtains or utilizes a minimal-scope API key associated with a super account, which satisfies the baseline api.access check enforced by requireApiKeyPermission().\nThe attacker then crafts an HTTP request to the API key creation endpoint, supplying an empty scopes array or arbitrary elevated scopes within the request body.\nBecause the vulnerable component lacks validation to ensure the requested scopes do not exceed the caller's authorized boundaries, the application successfully provisions a new API key.\nThis newly minted API key bypasses all intended scope restrictions, granting full-access super privileges to the attacker.\nPost-exploitation impact is severe, as the newly acquired full-access super key can be leveraged to execute subsequent attack chains, including writing malicious system configurations that lead directly to remote code execution (RCE) on the affected infrastructure."
}