A critical authorization bypass vulnerability in the Grav API plugin allows attackers with restricted API keys to perform unauthorized administrative actions, including the compromise of super-admin accounts.

This is an incorrect authorization vulnerability (CWE-863) within the UsersController.php file. The requireNotSuperTarget function fails to verify if an API key possesses the required scope, instead relying on an insufficient check of the account status, which allows unauthenticated attackers (possessing a scoped key) to manipulate sensitive administrative settings.

The ability for an attacker to disable 2FA, delete avatars, or manage API keys for super-admin accounts poses a severe threat to the integrity and security of the Grav instance. Given the CVSS score of 9.8, this vulnerability allows for total administrative account takeover, which could lead to full system compromise, unauthorized data access, and significant reputational damage.

Immediate Action: Update the Grav API plugin to version 1.0.18 or later immediately to resolve the authorization logic flaw.

Proactive Monitoring: Review web server and application access logs for unusual patterns of API calls directed at user management endpoints, particularly those attempting to modify security settings or API key configurations.

Compensating Controls: Implement strict API key management policies and restrict the exposure of administrative endpoints at the network perimeter, utilizing a Web Application Firewall (WAF) to block suspicious requests targeting the UsersController.

Public Exploit Available: Unknown

This vulnerability represents a critical risk to any Grav installation utilizing the API plugin. Security teams should prioritize patching to version 1.0.18 as the primary defense, as there are no effective workarounds that maintain full functionality while securing the vulnerable endpoints. Failure to remediate could result in a complete loss of control over administrative access to the platform.