Description

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T11:16:39.647Z",
  "pubdate": "2026-08-26T11:16:39.647Z",
  "executiveSummary": "The getgrav/grav-plugin-api plugin prior to version 1.0.18 contains a critical authorization vulnerability within the UsersController.php component.\nThe flaw stems from an improper implementation of access control checks, specifically within the requireNotSuperTarget() function.\nInstead of validating if a specific API key possesses the necessary super-authority scope to perform sensitive actions on target user accounts, the application incorrectly relies on a global isSuperAdmin() check associated with the parent account.\nThis allows an attacker possessing a restricted API key—provided it belongs to a super-admin account—to bypass intended scope limitations and perform unauthorized administrative actions against other super-admin accounts.\nImpacted operations include the modification of 2FA configurations, deletion of avatars, and the unauthorized creation or deletion of API keys belonging to other administrative entities.\nThe vulnerability essentially permits privilege escalation within the context of super-administrator accounts, granting restricted keys the power of a full super-admin despite assigned scoping limitations.\nExploitation requires an existing API key associated with a super-admin account, making this a significant risk for environments utilizing fine-grained API access controls.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper authorization logic flaw within the UsersController.php file of the getgrav/grav-plugin-api plugin.\nThe function requireNotSuperTarget() is designed to restrict administrative actions against other high-privileged accounts. However, the implementation uses an incorrect verification method: it calls isSuperAdmin() on the actor's account object rather than validating the specific API key's capability via isSuperWithinScope().\nIn a secure configuration, an API key scoped with limited permissions should be restricted from performing management operations on other super-admin accounts, even if the key is generated by a super-admin user.\nBecause the application logic relies on the global status of the owner rather than the scope of the key, the system fails to differentiate between a full-privileged session and a restricted API-based session.\nThe attack flow proceeds as follows: 1) An attacker obtains or utilizes an API key scoped for a super-admin account, where the key itself should have restricted authority. 2) The attacker issues requests to one of the seven sensitive user-management endpoints protected by requireNotSuperTarget(). 3) The backend receives the request and checks the parent account's status via isSuperAdmin(), which returns true. 4) The application incorrectly bypasses the scope enforcement check because it validates the account's inherent global rank instead of the key's specific authorization scope. 5) The sensitive administrative action is executed, allowing the attacker to manipulate targeted super-admin user accounts.\nAffected versions include all versions of the getgrav/grav-plugin-api plugin prior to 1.0.18.\nThe vulnerability manifests across seven specific user-management endpoints, facilitating high-impact operations such as disabling 2FA, avatar removal, and the unauthorized generation or revocation of API keys.\nThis vulnerability effectively renders API key scoping ineffective for protecting other administrative accounts, enabling lateral movement and administrative account takeover when an attacker possesses a scoped key derived from a super-admin."
}