Executive brief
The Grav API Plugin provides headless content access to Grav CMS sites via API keys. Prior to version 1.0.6, the plugin failed to enforce API key scopes during authentication, allowing a "read-only" API key to perform all write, delete, and administrative operations available to its owner account. This enables attackers with a scoped API key to gain full control over the site's content and configuration.
Technical details
The vulnerability stems from a scope enforcement bypass in the API key authentication flow. The ApiKeyManager::generateKey() method stores declared scopes in the key data, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the full owning user's complete identity. AbstractApiController::requirePermission() then evaluates the complete user ACL rather than the key's declared scopes, allowing a read-only key to bypass all authorization checks. No authentication is required beyond possession of a valid API key. The fix in version 1.0.6 ensures scopes are passed through the authentication chain and enforced in the authorization check, capping key privileges even for super-admin-owned keys.
Affected products
- Grav API Plugin before 1.0.6
Timeline
- 2026-08-19: disclosed
- 2026-06-26: patched: fix released in version 1.0.6