Executive brief
The Grav API plugin is a component that allows programmatic access to Grav CMS content via API keys with restricted permissions ("scoped keys"). A flaw in the injectSecurityTab() function fails to enforce these permission restrictions when displaying or allowing edits to page security settings, allowing someone with a limited API key to view and potentially modify permissions beyond what their key should grant. This defeats the purpose of using restricted API keys and exposes sensitive access control settings.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the injectSecurityTab() function of BlueprintController within the Grav API plugin. The function uses raw isSuperAdmin() and hasPermission() checks without a request parameter, preventing it from enforcing the scopeAllows() scope cap that is consistently applied elsewhere in the codebase. An attacker holding a scoped API key can request the page blueprint, which will incorrectly expose and permit editing of security/permissions fields beyond the scope granted to the key. The reporter confirmed the information disclosure aspect (revealing full account permissions rather than scoped key limits) but noted that end-to-end write impact depends on whether the blueprint field presence gates write-time enforcement, which was not fully traced. The fix is to thread the request object into injectSecurityTab() to enable proper scope enforcement, matching the established pattern used in hasPermissionWithinScope().
Affected products
- Grav API plugin before 1.0.18
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: version 1.0.18