Executive brief
A security flaw in the Grav CMS API plugin allows users with limited administrative permissions to upgrade themselves to full "super-admin" status. By exploiting unprotected endpoints, a restricted manager can generate secret keys for high-level accounts or disable their two-factor authentication. This allows an attacker to take complete control over the website, access sensitive data, and modify any site settings.
Technical details
A privilege escalation vulnerability exists in the grav-plugin-api due to missing authorization checks in the UsersController. While previous fixes (GHSA-p97c) protected the update, create, and delete endpoints, the createApiKey, generate2fa, and disable2fa endpoints remained unguarded. An attacker with 'api.users.write' permissions can target a super-admin account to mint an API key that inherits the target's full privileges, bypassing scope restrictions. Additionally, the attacker can rotate or disable the target's 2FA settings. This vulnerability is patched in version 1.0.6.
Affected products
- getgrav grav-plugin-api < 1.0.6
Timeline
- 2026-06-29: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: NVD publication date