The Grav API plugin before version 1.0.13 fails to enforce API key scope caps within ConfigController’s scope gates. An attacker possessing a scoped api.config.write key issued from a super account can write arbitrary shell commands into the scheduler.custom_jobs configuration. When the scheduler runs, Symfony’s Process component blindly executes those commands as the web server user, enabling full remote code execution. This is a broken access control vulnerability (CWE‑269).

This flaw affects deployments of the Grav Content Management System that use the API plugin before version 1.0.13. Those environments are typically PHP‑based web servers with Symfony components for scheduling. Any installation that exposes the API endpoint for scheduler administration and uses a scoped api.config.write key is potentially vulnerable.

The flaw has a CVSS score of 8.7, signifying critical severity. It is not listed in the CISA KEV catalog and has an EPSS score of < 1 %, indicating a very low but nonzero exploitation probability. The most likely attack vector is via the public API endpoint that accepts scheduler configuration, as an attacker with a scoped api.config.write key can inject commands. Successful exploitation would give the attacker full control of the affected system.