The Grav API plugin version prior to 1.0.8 allows users who have only the admin.login role to generate or revoke API keys for any account by specifying the target account in the request. This gives them full API permissions tied to the target account, including administrative write access and the api.super scope, thus enabling them to create a key with unrestricted privileges. The effect is a privilege escalation within the CMS for a lower‑privileged administrator.

Grav CMS installations that use the Grav API plugin version 1.0.7 or earlier. The plugin is distributed as grav-plugin-api by getgrav. Sites employing older releases than 1.0.8 are directly affected because the authorization checks for key generation and revocation are only present in 1.0.8 and later.

The CVSS score of 8.7 indicates high severity. An attacker only needs to be authenticated with the admin.login role to exploit this weakness, with no additional network access or remote code execution required. The EPSS score of <1% indicates a very low estimated exploitation probability, though the vulnerability remains high risk because of the privileged outcome. The vulnerability is not listed in the CISA KEV catalog, and the only requirement for exploitation is possession of an admin.login account.