Executive brief
Grav's API plugin is used to manage content and administrative functions via authenticated API keys. This vulnerability allows an attacker with a restricted API key (issued on a privileged account) to bypass scope restrictions and view UI metadata, item definitions, and configuration details they should not have access to. While read-only, this information disclosure could expose sensitive operational details and aid further attacks.
Technical details
The userPassesAuthorize() function in AbstractApiController.php fails to validate API key scopes when determining authorization for gated UI items. It checks the underlying user account's raw super-admin flag and ACL permissions without consulting the calling request's declared api_key_scopes. An attacker with a scoped API key (e.g., restricted to ["api.access", "api.pages.read"]) minted on a super-admin account can bypass scope restrictions to access authorize-gated sidebar/menubar/widget items and users-list metadata that the key's declared scope should deny. The vulnerability affects six call sites across multiple controllers (SidebarController, FloatingWidgetController, EditorButtonsController, MenubarController, UsersController). Exploitation requires a valid API key and is read-only; patches are available in version 1.0.14.
Affected products
- getgrav grav-plugin-api before 1.0.14
Timeline
- 2026-08-18: disclosed
- 2026-08-18: patched: Version 1.0.14 released