The Grav API plugin contains a flaw that lets a scoped API key bypass its intended read‑only restrictions. When such a key, for example one with 'api.pages.read' permission, is used against four critical write endpoints—GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController—the plugin’s super‑admin early‑return skips the required permission check. Consequently, the key can perform super‑admin write actions, such as rewriting group ACL maps to grant super‑admin rights to arbitrary accounts. The flaw enables attackers to gain full super‑admin write capability, undermining the integrity of the entire site. This weakness is classified as CWE‑269, reflecting an improper authorization vulnerability.

Vendors affected are Grav, specifically the Grav content management system. The vulnerability spans plugin versions from 1.0.6 through 1.0.11. Any site using those versions is susceptible; the issue was fixed in version 1.0.13 and later.

The CVSS score of 8.7 signifies a high‑severity issue. EPSS data is not available, so the exact likelihood of exploitation cannot be quantified. Based on the description, it is inferred that the attack vector is remote exploitation of the Grav API via an exposed or stolen scoped API key; an attacker need only access the API endpoint to trigger the vulnerability. A compromised read‑only key—often employed in CI or monitoring contexts—provides the necessary credential for the attack. The vulnerability is not listed in the CISA KEV catalog.