The Grav plugin API fails to verify that the caller is a super‑administrator when handling the createApiKey, generate2fa, and disable2fa endpoints. As a result, a user with the api.users.write role, which normally does not have super‑admin authority, can generate API keys that are bound to super‑admin accounts or disable two‑factor authentication for super‑admin users. This flaw allows an attacker to gain full super‑admin control of the Grav instance, enabling any system‑wide action normally reserved for trusted administrators.

The vulnerability affects the Grav content‑management system, specifically the grav-plugin-api component, for all releases earlier than 1.0.6. No other vendors or product versions are listed as susceptible.

The CVSS score of 8.7 indicates a high‑severity vulnerability, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not catalogued in CISA’s KEV registry. Based on the description, the likely attack vector involves an authenticated user with api.users.write permissions invoking the compromised endpoints; the attacker could either mint a super‑admin API key or strip two‑factor authentication from a super‑admin, thereby achieving a full instance takeover. The exploitation requires only API access with the above role, making the attack relatively straightforward for compromised accounts.