A critical privilege management flaw in the Grav API plugin enables unauthenticated attackers to promote accounts to super-user status, leading to total system compromise.

This is an improper privilege management vulnerability (CWE-269) where the system performs an insufficient check on administrative grants. The application fails to verify the API key scopes before allowing promotion to super-user privileges.

The ability to elevate any account to super-user status grants an attacker full control over the application. With a CVSS score of 9.8, this vulnerability allows for data exfiltration, administrative manipulation, and potential persistence mechanisms that threaten the entire business operation.

Immediate Action: Update the grav-plugin-api to version 1.0.13 or later immediately.

Proactive Monitoring: Review user account lists for unauthorized administrative accounts and monitor API usage logs for unusual promotion activities.

Compensating Controls: Utilize a WAF to block unauthorized API requests and enforce the principle of least privilege by auditing existing API key capabilities.

Public Exploit Available: No

Given the availability of a proof-of-concept and the critical nature of the vulnerability, immediate patching is required. Administrators should verify all current user accounts for signs of unauthorized promotion following the update.