A vulnerability in the Grav API Plugin allows authenticated attackers to bypass authorization controls, potentially leading to unauthorized data access and modification.

This is an authorization bypass vulnerability (CWE-639, CWE-862) within the RESTful API component. The plugin fails to properly validate the authorization level of authenticated users, permitting unauthorized access to site content.

The ability to bypass authorization controls means that an authenticated user could potentially view, modify, or delete sensitive site content, leading to data breaches or site defacement. With a CVSS score of 8.8, this poses a substantial risk to the integrity and confidentiality of the CMS content.

Immediate Action: Update the grav-plugin-api to version 1.0.6 or higher to resolve the authorization logic flaws.

Proactive Monitoring: Monitor API access logs for anomalous requests or attempts to access content that typically requires higher administrative privileges.

Compensating Controls: Implement WAF rules to validate API requests and restrict access to sensitive endpoints based on user roles until the update is applied.

Public Exploit Available: No.

Administrators should treat this update as mandatory to maintain the security posture of their CMS. The lack of authorization checks makes the API a high-value target for authenticated users looking to escalate their access.