The Grav API Plugin before version 1.0.10 does not enforce restrictions on write access to security‑critical configuration scopes. Authenticated users possessing an api.config.write privilege can modify rate‑limiting parameters and CORS settings. This flaw allows an attacker to disable rate limiting across the entire site, facilitating credential‑brute‑forcing attacks, and to reconfigure CORS to include attacker‑controlled origins with credentials enabled, potentially exposing user data. The weakness corresponds to CWE‑862, an access‑control failure.

All installations of the Grav API Plugin from getgrav:grav prior to version 1.0.10 are vulnerable. No specific patch level information is provided beyond the 1.0.10 release threshold.

The CVSS score of 8.2 classifies the vulnerability as high severity. The EPSS score of less than 1% indicates a low current exploitation probability, yet the impact remains serious if exploited. Attackers would need an authenticated account with the api.config.write privilege and can then send legitimate configuration‑write API calls to alter rate limiting or CORS. Although the vulnerability is not listed in the CISA KEV catalog, its potential to enable credential‑brute‑forcing and cross‑origin data leakage makes it a notable threat.