A critical vulnerability in the Grav API plugin allows unauthenticated attackers to escalate privileges by minting administrative API keys, posing a total risk to system integrity.

This is an incorrect privilege assignment vulnerability (CWE-266) within the createApiKey function. The application fails to perform a subset check on requested scopes, allowing an attacker with minimal privileges to mint a super-user key.

Successful exploitation results in full administrative control over the Grav instance. Given the critical CVSS score of 9.8, this flaw facilitates complete system compromise, including the potential for unauthorized configuration changes and remote code execution.

Immediate Action: Update the grav-plugin-api to version 1.0.13 or later immediately.

Proactive Monitoring: Audit existing API keys for unexpected administrative scopes and monitor system logs for suspicious key generation events.

Compensating Controls: Implement a Web Application Firewall (WAF) to restrict access to the API endpoints and employ strict network segmentation to limit exposure of the administrative interface.

Public Exploit Available: No

This vulnerability represents a severe security risk that enables total account takeover. Organizations must prioritize patching to version 1.0.13 to prevent unauthorized privilege escalation and ensure the integrity of the Grav environment.