Executive brief
Grav API Plugin provides RESTful access to Grav CMS content. Before version 1.0.6, non-super administrative users with limited API write permissions can create API keys and modify two-factor authentication settings for super-administrator accounts. An attacker with restricted credentials can escalate to full super-administrator privileges and create persistent backdoor access, compromising the entire site.
Technical details
The vulnerability is a missing access control check (CWE-284) in the API plugin's UsersController class, specifically in the createApiKey(), generate2fa(), and disable2fa() methods. These endpoints fail to call the accessGrantsSuper() guard that protects sibling endpoints, allowing a non-super user with api.users.write permission to target super-administrator accounts. An attacker can mint API keys bound to access.api.super targets, obtain full privileges because key scopes are not enforced, and disable or rotate the target's 2FA protection. The vulnerability requires authenticated API access with limited write permissions and is reachable over the network. Version 1.0.6 adds the missing requireNotSuperTarget() guard to all affected endpoints.
Affected products
- Getgrav API Plugin before 1.0.6
Timeline
- 2026-08-19: disclosed
- 2026-06-26: patched: Fix committed; version 1.0.6 released 29 Jun