Description

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin()/hasPermission() checks without a request parameter, it cannot enforce scopeAllows(). A caller holding a scoped API key may therefore see (and potentially edit) page permission fields beyond the scope granted to the key. The end-to-end write-time impact was not fully confirmed by the reporter.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-26T11:16:39.797Z",
  "pubdate": "2026-08-26T11:16:39.797Z",
  "executiveSummary": "The Grav API plugin, specifically versions prior to 1.0.18, is susceptible to an improper authorization vulnerability within the BlueprintController. This flaw arises from a failure to correctly apply API-key scope limitations during the execution of the injectSecurityTab() function.\nThe vulnerability allows an authenticated attacker possessing a scoped API key to bypass restricted permissions. By performing raw security checks—isSuperAdmin() and hasPermission()—without verifying the current request context or the associated API key scope, the application fails to enforce granular access controls defined for that specific key.\nThis represents a significant security risk, as unauthorized users may gain visibility into sensitive page security configurations and potentially modify permission fields that should be outside their designated scope. The issue essentially creates a privilege escalation path where an attacker can interact with administrative components of the Grav CMS beyond their authorized administrative boundary. Exploitation requires the attacker to possess a valid, albeit scoped, API key, enabling them to leverage the flaw to potentially compromise the integrity of page-level access controls.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the injectSecurityTab() function within the BlueprintController component of the getgrav/grav-plugin-api plugin. The function is responsible for determining whether the security or permissions section of a page's blueprint should be rendered as editable within the API context.\nThe vulnerability occurs because the function relies on absolute permission checks, specifically calls to isSuperAdmin() and hasPermission(), which operate independently of the request's context. In a properly secured API environment, these checks should be mediated by the scopeAllows() function, which validates whether the action performed by an API key is authorized within its defined scope. By omitting the request-aware scope validation, the function inadvertently grants full access to the security tab if the underlying user or key is authenticated, ignoring the constraints intended for restricted API access.\nThe attack flow proceeds as follows: 1) An attacker authenticates with a scoped API key that has limited access rights. 2) The attacker issues a request that triggers the BlueprintController's injectSecurityTab() function. 3) The function performs an evaluation using native, high-privileged check functions that verify general user authorization but fail to consult the scope-based restriction logic. 4) The application incorrectly evaluates the security tab as editable due to the global check returning true, even though the specific API key scope should have prohibited this action. 5) The attacker receives the response containing the sensitive blueprint fields, or is permitted to submit updates to these fields, effectively bypassing the intended security restrictions.\nThis flaw effectively allows an attacker to interact with the security and permission configurations of pages that should be protected from their specific user context. While the full impact of write-time exploitation was not explicitly confirmed by the reporter, the ability to see and potentially manipulate these fields poses a critical risk to site integrity, potentially allowing for unauthorized modification of page access controls and the escalation of privileges within the CMS architecture.\nThe issue is confirmed in versions of getgrav/grav-plugin-api before 1.0.18. Successful exploitation requires a valid API key, though the level of access granted by the key does not need to align with the administrative actions performed, as the check logic is bypassed during the blueprint injection process."
}