A critical authorization flaw in the grav-plugin-api allows authenticated users to escalate privileges to super-admin status, posing a severe risk to system integrity.

This is an incorrect authorization vulnerability (CWE-863) where the plugin fails to enforce proper permission checks for group-inherited super-admin privileges. An attacker who is already authenticated with api.access and api.users.write capabilities can exploit this to modify administrative account passwords and gain complete control over the application.

The ability for a standard user to elevate their privileges to super-admin represents a total compromise of the application management layer. Given the CVSS score of 8.7, this vulnerability carries a high severity rating that could lead to unauthorized data access, total system takeover, and the potential for persistent backdoors. Organizations relying on this plugin for user management face significant risk of operational disruption and data breach.

Immediate Action: Update the grav-plugin-api to version 1.0.20 or later, which contains the necessary security fixes to enforce correct authorization checks.

Proactive Monitoring: Review API access logs for anomalous activity, specifically monitoring for unusual password modification requests originating from non-administrative user accounts.

Compensating Controls: If immediate patching is not feasible, restrict API access permissions to only the most trusted service accounts and implement Web Application Firewall rules to monitor for suspicious patterns in user management endpoints.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

The severity of this vulnerability necessitates immediate action. Administrators must prioritize updating the grav-plugin-api to the latest version to prevent unauthorized administrative escalation. Failure to patch this vulnerability leaves the entire user-management ecosystem exposed to total account takeover.