The Grav API Plugin is susceptible to an authorization bypass vulnerability, potentially allowing unauthorized access to sensitive site configuration and user data.

This is an authorization flaw (CWE-863) within the RESTful API component. It allows an attacker to interact with site content, media, and system management functions without proper validation of user privileges.

With a CVSS score of 8.8, this vulnerability presents a high risk of total system compromise. Unauthorized access to the Grav CMS through the API could result in data exfiltration, unauthorized modification of site configuration, and potential takeover of administrative accounts.

Immediate Action: Upgrade the Grav API Plugin to version 1.0.0-beta.15 or later immediately to resolve the authorization logic error.

Proactive Monitoring: Audit API access logs for unauthorized attempts to access administrative endpoints or system configuration files.

Compensating Controls: Restrict access to the API endpoints via IP whitelisting or disable the API plugin entirely if it is not required for current site operations.

Public Exploit Available: false

Administrators must verify their current plugin version and apply the update immediately. Given that this vulnerability allows for total system impact, failure to patch could lead to a complete compromise of the CMS.