An authenticated missing authorization vulnerability in the getgrav grav-plugin-api could allow unauthorized integrity impacts on the affected system.

This vulnerability, classified as CWE-862, occurs because the application fails to perform adequate authorization checks for API requests. An attacker with low-level privileges can exploit this to perform actions they are not authorized to access.

With a CVSS score of 7.6, this vulnerability carries significant risk regarding the integrity of data within the Grav environment. Unauthorized access to administrative or sensitive functions could lead to data manipulation, unauthorized configuration changes, and potential service disruption, affecting the overall security posture of the platform.

Immediate Action: Update the grav-plugin-api to version 1.0.13 or later to ensure that proper authorization checks are enforced.

Proactive Monitoring: Review application logs for suspicious API calls or unexpected administrative actions performed by low-privileged user accounts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block suspicious API requests that attempt to access restricted controller endpoints.

Public Exploit Available: No

Given the evidence of a proof-of-concept, prompt remediation is required to secure the Grav installation. Administrators should apply the 1.0.13 update immediately to mitigate the risk of unauthorized privilege escalation and data manipulation.