Description

The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin()-gated write endpoints (in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController). These endpoints authorize via a super-admin early-return that never invokes requirePermission()—the sole enforcement point of the scope cap—so a 'read-only'-scoped key (e.g. api.pages.read) can perform super-only write operations, including rewriting group ACL maps to grant super-admin privileges to arbitrary accounts. A leaked or delegated read-only CI/monitoring key can therefore gain full super-admin write capability. Fixed in 1.0.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T12:16:46.670Z",
  "pubdate": "2026-08-14T12:16:46.670Z",
  "executiveSummary": "A privilege escalation vulnerability exists in the Grav API plugin (getgrav/grav-plugin-api) versions 1.0.6 through 1.0.11. The flaw allows a scoped API key minted on a super-admin account to bypass its declared scope cap on four critical super-admin-gated write endpoints. Consequently, an attacker or compromised entity in possession of a restricted, read-only-scoped API key—such as api.pages.read—can execute arbitrary super-only write operations. The high-risk impact includes rewriting group ACL maps to confer full super-admin privileges to arbitrary user accounts. This introduces severe risk implications for environments utilizing leaked or delegated continuous integration and monitoring keys, allowing unauthorized actors to achieve full administrative control over the underlying Grav CMS installation.",
  "technicalDetails": "The vulnerability resides in the Grav API plugin (getgrav/grav-plugin-api) across versions >= 1.0.6 and <= 1.0.11, specifically within four write-capable controllers: GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController. The root cause of the privilege escalation is an authorization bypass mechanism within the affected endpoints. When these endpoints are accessed using an API key minted on a super-admin account, authentication relies on a super-admin early-return validation check. This check immediately authorizes the request without ever invoking requirePermission(), which functions as the sole enforcement mechanism responsible for validating and enforcing the declared scope cap associated with the API key.\nBecause requirePermission() is bypassed during the early return, a restricted API key possessing only read-level scopes—such as api.pages.read—is improperly granted write access to super-admin-gated operations. The attack flow involves an adversary utilizing a leaked, intercepted, or delegated read-only CI or monitoring API key to target the vulnerable endpoints. By issuing specially crafted HTTP write requests to the affected controllers, the attacker circumvents intended perimeter defenses and scope restrictions. Post-exploitation impact is severe, as the attacker can manipulate system configurations, modify user accounts, and execute administrative actions. Most notably, an attacker can rewrite group Access Control List (ACL) maps, thereby escalating privileges to grant full super-admin capabilities to arbitrary user accounts within the application."
}