Description

Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so a least-privilege API key (scoped to api.users.write) minted on a super account can create an invitation record containing super-admin access flags. When the invitation is accepted, those flags are written verbatim to the new account, resulting in privilege escalation to a fully controlled super account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-14T12:16:46.030Z",
  "pubdate": "2026-08-14T12:16:46.030Z",
  "executiveSummary": "An improper authorization vulnerability exists in the Grav Plugin API (getgrav/grav-plugin-api) prior to version 1.0.13 within the InvitationsController. This flaw allows a least-privilege API key, specifically one scoped only to api.users.write and minted on a super account, to bypass intended API-key scope limitations. The vulnerability impacts Grav instances utilizing vulnerable versions of the Plugin API, presenting severe risk implications as it enables horizontal or vertical privilege escalation. An attacker possessing a restricted least-privilege API key can successfully forge invitation records containing super-admin access flags. Exploitation requires the generation of a scoped API key from a privileged account and the subsequent creation and acceptance of a manipulated invitation payload. Upon acceptance of the invitation, the injected access flags are written verbatim to the newly created user account, granting the attacker complete control via a fully privileged super administrator account.",
  "technicalDetails": "The vulnerability resides in the InvitationsController component of the Grav Plugin API (getgrav/grav-plugin-api) in versions prior to 1.0.13. The root cause of the flaw is the failure to properly enforce API-key scope caps during invitation processing. Specifically, critical security decisions regarding strip-super and accept-groups are gated entirely on a bare isSuperAdmin() check rather than performing a granular, scope-aware permission validation.\nAuthentication and authorization mechanisms are bypassed due to this insecure check. When an API key is minted on a super account with restricted scopes—such as api.users.write—the system improperly validates the key's assigned scopes against the requested operation. Because the check only verifies if the underlying account is a super admin rather than evaluating whether the specific API key scope permits the modification of administrative flags, unauthorized parameter manipulation is allowed.\nThe step-by-step attack flow proceeds as follows: First, an attacker obtains or generates a least-privilege API key scoped strictly to api.users.write, minted from a super administrator account. Second, the attacker interacts with the InvitationsController to create a new invitation record. During this request, the attacker injects super-admin access flags into the invitation payload. Because the controller relies on the bare isSuperAdmin() evaluation, it fails to strip these unauthorized flags from the request data. Third, the invitation is accepted by the target or the attacker. Finally, the injected super-admin access flags are written verbatim directly to the newly provisioned user account. This results in an immediate privilege escalation, granting the newly created account full super-administrator privileges and total control over the affected Grav application."
}