A low‑privileged authenticated API user possessing the api.media.write capability can misuse the /api/v1/blueprint-upload endpoint to write an arbitrary YAML file into the user/accounts/ directory of Grav 2.0.0‑beta.2. By creating a file that defines a new account with api.super privileges, the attacker can log in as a super‑admin, gaining full control over the Grav API. The weakness is rooted in improper authorization (CWE‑269) and insecure file handling (CWE‑434).

This flaw affects all installations of Grav running version 2.0.0‑beta.2 or earlier that expose the blueprint‑upload API. The issue is fixed in Grav API 1.0.0‑beta.17 and later releases. Users of the getgrav:grav product should verify the installed API version and apply the patch if needed.

The CVSS score of 8.7 classifies the vulnerability as high severity. While an EPSS score is not available, the existence of a documented exploitation path and the absence of a KEV listing suggest that the flaw can be reasonably exploited over the network by any authenticated user with api.media.write rights. Attackers can remotely upload a crafted file through HTTP, making the vulnerability likely exploitable without additional preconditions.