CyberRota Analysis
AI-GeneratedThe getgrav/grav-plugin-api plugin prior to version 1.0.18 is vulnerable due to improper API key scope enforcement, allowing super-admin accounts to misuse lower-scoped API keys to manipulate other super-admin accounts. This critical flaw can lead to severe consequences, including disabling two-factor authentication, deleting user avatars, and unauthorized API key management. Organizations using this plugin, particularly those with sensitive user management functions, should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.