Description

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize(), the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only checks the baseline api.access permission and never evaluates the authorize field a plugin registered for that action. Any authenticated caller with api.access can therefore invoke a privileged menubar action directly, bypassing the intended authorization. No plugin bundled with core Grav currently registers a privileged authorize handler, so on a stock install the impact is latent; the flaw affects any first- or third-party plugin relying on the documented authorize semantics.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T12:19:33.780Z",
  "pubdate": "2026-08-18T12:19:33.780Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the Grav API plugin (getgrav/grav-plugin-api) prior to version 1.0.14, specifically within the admin-next/API stack. The flaw stems from a failure to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint properly filters items using userPassesAuthorize(), the POST endpoint at /api/v1/menubar/actions/{plugin}/{action} solely evaluates the baseline api.access permission and omits the evaluation of the specific authorize field registered by plugins for that action.\nThe impact allows any authenticated caller possessing the baseline api.access permission to directly invoke privileged menubar actions, effectively bypassing intended authorization controls. Although stock installations containing only core Grav plugins do not currently register privileged authorize handlers—rendering the direct impact latent on default setups—any first-party or third-party plugin relying on documented authorize semantics is vulnerable.\nExploitation requires network access to the API stack and valid authentication with baseline api.access privileges. The risk profile depends heavily on third-party or custom plugins installed in the environment that define sensitive administrative actions relying on these authorization checks.",
  "technicalDetails": "The vulnerability resides in the getgrav/grav-plugin-api package, specifically affecting versions prior to 1.0.14. The root cause is an inconsistent authorization check implementation within the MenubarController component of the Grav admin-next/API stack.\nDuring normal operations, listing endpoints such as GET /menubar/items correctly enforce security controls by invoking userPassesAuthorize(), ensuring that users only view items they are permitted to access. However, the execution endpoint, specifically POST /api/v1/menubar/actions/{plugin}/{action}, fails to replicate this granular check. Instead of validating the authorize field that a plugin registers for a specific action, the controller only validates the generic baseline api.access permission.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker obtains baseline api.access privileges, which may be standard for low-privileged dashboard users. Second, the attacker identifies a target action provided by a first- or third-party plugin that was intended to be restricted by a specific authorize configuration. Third, the attacker crafts an HTTP POST request targeting the vulnerable endpoint /api/v1/menubar/actions/{plugin}/{action}, bypassing the missing authorization evaluation. Finally, the server processes the request and executes the privileged action despite the user lacking the requisite administrative clearance for that specific operation.\nThe vulnerable component is MenubarController::executeAction() located within the Grav API plugin. Network exposure is restricted to authenticated users capable of reaching the API endpoints. While core Grav plugins do not utilize privileged authorize handlers, third-party extensions implementing such handlers are fully exposed to unauthorized execution vectors."
}