CyberRota Analysis
AI-GeneratedThe Grav API plugin prior to version 1.0.18 is vulnerable due to insufficient scope enforcement in the injectSecurityTab() function, allowing users with scoped API keys to access and potentially modify page permission fields beyond their authorized limits. This flaw poses a medium risk as it could lead to unauthorized changes in page security settings. Organizations using this plugin should prioritize patching to mitigate the risk of privilege escalation and unauthorized access to sensitive configurations.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin()/hasPermission() checks without a request parameter, it cannot enforce scopeAllows(). A caller holding a scoped API key may therefore see (and potentially edit) page permission fields beyond the scope granted to the key. The end-to-end write-time impact was not fully confirmed by the reporter.