Executive brief
The Grav API plugin, which allows external applications to interact with the Grav content management system, contains a flaw in how it handles security permissions for API keys. While administrators can create keys intended for limited tasks (such as read-only access), the system fails to enforce these restrictions, granting the key the full administrative power of the account that created it. This could allow a person or automated script with a restricted key to perform unauthorized actions, such as deleting content or modifying system settings.
Technical details
An authorization bypass exists in the Grav API plugin (getgrav/grav-plugin-api) due to the 'scopes' array being ignored during the authentication process. While the ApiKeyManager allows for the creation and storage of scoped keys (e.g., 'api.pages.read'), the ApiKeyAuthenticator class only validates the key's existence and expiry before returning the full UserInterface object of the owner. Consequently, the requirePermission() check in the AbstractApiController evaluates the user's full Access Control List (ACL) rather than the restricted scopes of the API key. An attacker with a low-privileged API key can perform write, delete, or administrative operations if the owning account has those permissions. This issue is fixed in version 1.0.6.
Affected products
- getgrav Grav API plugin (getgrav/grav-plugin-api) < 1.0.6
Timeline
- 2026-06-29: advisory: Vendor advisory published on GitHub
- 2026-07-17: disclosed: NVD publication date
- 2026-07-17: patched: Fix released in version 1.0.6