Executive brief
The Grav API plugin incorrectly validates permissions for sensitive user-management operations, allowing a scoped API key belonging to an administrator to act against other administrators' accounts. An attacker with such a key can disable two-factor authentication, delete avatars, create new API keys, or delete existing keys on other admin accounts, effectively gaining unauthorized control without needing full administrator privileges.
Technical details
The vulnerability is an incorrect authorization check (CWE-863) in the requireNotSuperTarget() function within UsersController.php. The function checks whether the current user account is a super-admin (isSuperAdmin()) rather than verifying whether the specific API key carries super authority (isSuperWithinScope()). This allows a scoped API key—restricted to less than full super authority—belonging to a super-admin account to bypass the scope cap across seven sensitive endpoints: rowAction(), uploadAvatar(), deleteAvatar(), generate2fa(), disable2fa(), createApiKey(), and deleteApiKey(). The fix requires passing the $request parameter (available at all call sites) to requireNotSuperTarget() and replacing isSuperAdmin() with isSuperWithinScope(), aligning with the codebase's documented authorization pattern and mirroring fixes applied to prior vulnerabilities (GHSA-p57v-xhv3-mf2w and GHSA-435x-66r2-jwv2).
Affected products
- Grav grav-plugin-api before 1.0.18
Timeline
- 2026-08-11: disclosed: GitHub Security Advisory GHSA-94q7-vrqr-cx5v published
- 2026-08-26: advisory: CVE-2026-80203 published on NVD
- 2026-08-26: patched: Version 1.0.18 released