The Grav API Plugin versions prior to 1.0.10 contain a missing validation check in InvitationsController::create(). When an authenticated caller with api.users.write rights submits an invitation, the groups field is accepted without verifying the invited account’s membership. If the supplied group grants api.super permissions, the new account inherits super‑administrator API access upon accepting the invitation. This flaw enables an attacker to elevate privileges from a normal user to full super‑admin without the need for an inviter to possess those rights. The vulnerability is a classic example of CWE‑269, an authorization bypass through privileged user assignment.

The vulnerability affects the Grav API Plugin, part of the Grav content‑management framework supplied by getgrav. All releases before 1.0.10 are impacted. The fault resides in the plugin code and requires the Grav application to be running a vulnerable plugin instance.

The CVSS score of 8.7 indicates a high severity. The EPSS score is below 1%, implying that although the flaw is serious, it is not widely seen in the wild. The vulnerability is not listed in the CISA KEV catalog. The exploit requires an authenticated user with api.users.write permission, which means an attacker must first be authenticated to the Grav API. Once in place, the attacker can craft invitation records that assign the target user to privileged groups, leading to automatic super‑admin rights upon acceptance. The attack is limited to internal users; no remote code execution is possible outside the API boundary.