Description

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a result, an api.users.write-scoped key minted on a super account can set access.api.super or assign a super-granting group to mint or promote a full super account, then authenticate as that account for uncapped administrative privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-14T12:16:46.157Z",
  "pubdate": "2026-08-14T12:16:46.157Z",
  "executiveSummary": "An API-key scope-cap bypass vulnerability exists in the Grav API plugin (getgrav/grav-plugin-api) prior to version 1.0.13.\nThe vulnerability resides within the UsersController's create() and update() methods, which improperly validate administrative privileges during user creation and modification processes.\nAn attacker possessing a restricted API key scoped strictly to api.users.write minted on a super account can exploit this flaw to assign super-granting groups or directly set access.api.super permissions.\nThis allows the creation or promotion of a full super account, enabling subsequent authentication with uncapped administrative privileges across the affected system.\nThe risk implication is severe, leading to complete administrative compromise of the Grav CMS instance via unauthorized privilege escalation.\nExploitation requires an initially valid API key with api.users.write scope generated from a super account.",
  "technicalDetails": "The vulnerability stems from improper authorization checks within the UsersController's create() and update() methods inside the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.13.\nSpecifically, these methods enforce the scope cap exclusively for the api.users.write permission, yet gate super-privilege grants entirely on a bare isSuperAdmin() check.\nThe isSuperAdmin() function reads access.api.super directly from the user data or context without verifying whether the interacting API key actually possesses the corresponding scope within its permitted boundaries.\nDuring the attack flow, an authenticated adversary uses a legitimately acquired API key minted under a super account but explicitly restricted to the api.users.write scope.\nBecause the scope-cap validation fails to cross-reference the requested privilege escalation against the API key's restricted scope limitations, the attacker can manipulate user payloads sent to the UsersController.\nThe attacker modifies the user payload to explicitly set access.api.super to true or assigns a user group that inherently grants super administrative privileges.\nUpon processing the create() or update() request, the vulnerable component accepts the unauthorized super-privilege grant, thereby minting or promoting the target user to a full super account.\nPost-exploitation, the attacker can authenticate directly as the newly minted or promoted super account, bypassing all intended architectural restrictions and gaining total administrative control over the Grav API plugin and underlying system.\nThe vulnerable component is the UsersController class within getgrav/grav-plugin-api versions below 1.0.13, accessible via network requests where the API plugin is enabled and exposed."
}