The Grav API plugin before 1.0.6 allows an attacker to create an API key with a limited scopes array, but the ApiKeyAuthenticator ignores these scopes and instead returns the full account object of the key owner. This means a key that is intended to be read‑only can perform any write, delete, or administrative action that the owning user can normally do. The vulnerability is an authorization bypass that results in privilege escalation within the Grav installation.

Affected is the Grav CMS (getgrav:grav) with the Grav API plugin (getgrav/grav-plugin-api) version earlier than 1.0.6. The issue was fixed in plugin release 1.0.6; all earlier versions remain vulnerable.

With a CVSS score of 8.6 the vulnerability is considered high severity. The EPSS score is <1 %, indicating a very low probability of widespread exploitation at the moment, and it is not listed in the CISA KEV catalog. Nevertheless, an attacker who knows or can guess an API key can send authenticated requests to any API endpoint and perform arbitrary privileged operations, affecting the entire system’s integrity and confidentiality. Attackers are likely to target systems with exposed API endpoints and could gain administrative control through a compromised key.