Description

Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a result, an authenticated attacker holding a scoped API key minted on a privileged account can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions (sidebar/menubar/widget items and users-list columns/row-actions/filter-tabs) that their key scope should deny, resulting in information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T12:19:33.647Z",
  "pubdate": "2026-08-18T12:19:33.647Z",
  "executiveSummary": "The Grav API plugin (getgrav/grav-plugin-api) prior to version 1.0.14 suffers from a missing authorization vulnerability specifically located in the userPassesAuthorize() function within AbstractApiController.php.\nThe vulnerability allows an authenticated attacker holding a restricted or scoped API key minted on a privileged account to completely bypass their declared API key scope restrictions.\nBy failing to validate the calling request's API key scopes and instead incorrectly falling back on the underlying account's raw super-admin flag and Access Control List (ACL) grants, the system improperly authorizes access to sensitive metadata and items.\nThe resulting impact is an information disclosure vulnerability.\nAttackers can leverage this flaw to access authorize-gated UI metadata and item definitions, including sidebar items, menubar items, widget items, users-list columns, row-actions, and filter-tabs, which should otherwise be restricted based on their token's scoped limitations.\nExploitation requires an authenticated attacker who possesses a valid, scoped API key generated from a privileged account.",
  "technicalDetails": "The root cause of this vulnerability lies in improper authorization enforcement within the userPassesAuthorize() function defined in AbstractApiController.php of the Grav API plugin.\nDuring API request handling, access control checks are expected to validate whether the specific operation or resource falls within the authorized permissions defined by the calling request's API key scopes.\nHowever, the vulnerable function fails to inspect or consult these API key scopes. Instead, it improperly relies on the raw super-admin flag and ACL grants associated with the underlying account that minted the key.\nConsequently, if an API key is generated from a privileged account but assigned narrow, restricted scopes intended to limit its operational boundary, those restrictions are bypassed.\nThe attack flow proceeds as follows: 1) An attacker obtains a scoped API key that was generated from a privileged account, where the key's assigned scopes are intentionally limited. 2) The attacker issues requests to the API endpoints governed by AbstractApiController.php. 3) The application invokes userPassesAuthorize() to determine authorization. 4) Due to the missing scope check, the function evaluates the underlying privileged account's super-admin status or broad ACL grants rather than the explicit API key scopes. 5) The request is erroneously authorized, granting the attacker access to restricted authorize-gated UI metadata and item definitions.\nThe vulnerable component is the AbstractApiController.php file, specifically the userPassesAuthorize() method in the Grav API plugin (getgrav/grav-plugin-api) for versions strictly before 1.0.14.\nThe exploitation prerequisites require authentication via an API key, specifically a scoped API key minted from a privileged account.\nThe post-exploitation impact is unauthorized information disclosure, allowing the retrieval of sensitive administrative UI components, sidebar/menubar/widget definitions, and users-list metadata (columns, row-actions, and filter-tabs)."
}