The Grav API plugin before version 1.0.13 contains a flaw that allows an attacker to bypass the API‑key scope cap in the DemoController, a classic example of CWE‑862 (Missing Authorization). The private requireSuper() method incorrectly returns early before invoking requirePermission(), meaning that any API key generated from a super‑admin account can perform demo baseline and reset operations without respecting its intended scope. This grants the attacker the ability to capture or force a reset of the demo environment, effectively giving them control over the demo engine when writable resources are configured.

The affected product is Grav, a content‑management system provided by getgrav. All releases prior to 1.0.13 are vulnerable; the fix is included in 1.0.13 and later.

With a CVSS score of 5.3, the vulnerability poses a moderate risk. Exploitation requires an active API key derived from a super‑admin account and an environment where demo mode is enabled with writable resources, limiting its impact to the demo subsystem rather than the entire site. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, indicating that widespread exploitation has not been observed yet.