A critical privilege escalation vulnerability in the Grav grav-plugin-api plugin allows authenticated users with limited permissions to gain unauthorized super-admin access, leading to full site control.

The vulnerability exists in the InvitationsController due to improper privilege management where the stripSuperFlags method fails to sanitize dot-keyed super flags. An attacker with minimal user management permissions can inject malicious flags into an invitation payload, bypassing security guards to create a new account with elevated administrative privileges.

The potential for unauthorized privilege escalation represents a severe risk to organizational security, as it grants attackers full administrative control over the Grav instance. With a CVSS score of 8.7, this flaw poses a high risk of complete system compromise, unauthorized data access, and potential long-term persistence within the application environment.

Immediate Action: Update the grav-plugin-api plugin to version 1.0.20 or later immediately to incorporate the necessary security sanitization.

Proactive Monitoring: Audit existing user accounts for suspicious additions and monitor application logs for unexpected invitations or unauthorized administrative role assignments.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and block suspicious API payloads containing dot-keyed flags until the patch can be applied.

Public Exploit Available: No

Given the severity of this privilege escalation, administrators must prioritize updating the grav-plugin-api to version 1.0.20. Failure to patch this vulnerability leaves the application susceptible to full site takeover by any user with basic management permissions. Apply the update as soon as possible to prevent potential unauthorized access and administrative account creation.