The Grav API Plugin fails to enforce the declared scopes on API keys. When a key is generated, the plugin stores a scopes array, but the authentication routine does not consult this array and instead returns the full identity of the key owner. As a result, even a key that is intended for read‑only access can invoke any endpoint of the API, allowing write, delete and administrative operations. This is a classic access‑control bypass (CWE‑862).

The vulnerability exists in the Grav API Plugin (getgrav:grav-plugin-api) for all releases preceding version 1.0.6. Users who are running Grav CMS with an older instance of this plugin are affected. The issue is resolved in the 1.0.6 release and later.

The CVSS score of 8.1 indicates a high‑severity flaw. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, but the flaw allows an attacker with knowledge of a valid API key to execute operations beyond intended permissions. The likely attack vector is through authenticated API calls using the compromised key; no additional system compromise is required. Given the high potential impact on confidentiality, integrity, and availability, the risk to systems remains high until mitigated.