Description

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.custom_jobs that execute via Symfony Process for remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-14T12:16:46.277Z",
  "pubdate": "2026-08-14T12:16:46.277Z",
  "executiveSummary": "An improper authorization vulnerability exists in the Grav API plugin versions before 1.0.13, specifically residing within the ConfigController super-scope gates. This security flaw enables attackers possessing a restricted, scoped api.config.write API key to bypass intended capability boundaries and modify sensitive configuration parameters.\nThe primary impact of this vulnerability is Remote Code Execution (RCE) on the underlying host operating system. By exploiting the broken access control mechanism, an authenticated attacker with limited privileges can inject arbitrary system commands into the scheduler configuration, which are subsequently executed by the application.\nThe affected product is the Grav API plugin for the Grav Content Management System, specifically all versions prior to 1.0.13. The risk implication is severe, as it transforms a low-privilege scoped API key into full system compromise.\nAttacker capabilities are defined by the possession of a scoped api.config.write API key, which is leveraged to perform unauthorized administrative-level write operations. Exploitation requires network access to the Grav API endpoint and a valid scoped API key capable of configuration write operations, allowing the attacker to manipulate the scheduler component and achieve arbitrary command execution via the Symfony Process component.",
  "technicalDetails": "The vulnerability is rooted in a logic flaw within the Grav API plugin versions before 1.0.13, specifically failing to enforce strict API key scope caps inside the ConfigController super-scope gates. While API keys are intended to be restricted to specific functional scopes, the validation logic incorrectly permits scoped keys to interact with sensitive administrative configurations.\nThe vulnerable component is the ConfigController within the Grav API plugin. The affected versions are all releases prior to 1.0.13. Exploitation requires network exposure of the Grav API and authentication via a scoped api.config.write API key, meaning the attacker must already possess limited API credentials.\nThe attack flow proceeds in a step-by-step manner. First, an attacker authenticates to the Grav API using a restricted API key that possesses the api.config.write scope. Second, the attacker issues a specially crafted HTTP request targeting the configuration controller to modify the scheduler settings. Because the ConfigController fails to properly validate the super-scope restrictions, the request is accepted, and the scheduler configuration is updated.\nSpecifically, the attacker targets the scheduler.custom_jobs parameter within the configuration payload, injecting arbitrary operating system commands into the job definition. Third, when the application executes its scheduled tasks, the injected commands are processed and executed via the Symfony Process component with the privileges of the web server user.\nThe payload behavior involves the persistence of malicious command strings within the application configuration files or database storage managed by Grav. The post-exploitation impact includes complete remote code execution, potential lateral movement within the network, access to sensitive file systems, and full compromise of the hosting environment."
}