A critical privilege management flaw in the Grav API plugin enables unauthenticated attackers to achieve remote code execution through command injection.

The vulnerability stems from improper privilege management within the ConfigController. Unauthenticated attackers can leverage scoped API keys to modify scheduler jobs, resulting in arbitrary OS command execution.

This flaw permits full remote code execution, which allows an attacker to compromise the underlying operating system. The ability to execute arbitrary commands poses a severe threat to business operations, data privacy, and overall infrastructure security. The CVSS score of 9.8 reflects the high potential for total system compromise.

Immediate Action: Update the Grav API plugin to version 1.0.13 or later to enforce proper scope validation.

Proactive Monitoring: Audit scheduler configuration files for unauthorized or unexpected job entries.

Compensating Controls: Use a Web Application Firewall to inspect and block suspicious API calls targeting configuration endpoints.

Public Exploit Available: Unknown.

Given the critical nature of this vulnerability, immediate remediation is required. Security teams should verify that all Grav instances are updated to version 1.0.13 or higher to prevent potential exploitation.