The Grav API plugin contains a missing authorization flaw in the userPassesAuthorize() method of AbstractApiController.php. The function fails to validate the API key scopes provided on the request and instead relies solely on the account’s super‑admin flag and ACL grants. This allows an authenticated attacker who possesses a scoped API key that was minted on a privileged account to bypass the declared scope limitations and retrieve UI metadata and item definitions that should be hidden, leading to sensitive information disclosure.

The vulnerability affects the Grav API plugin (getgrav/grav-plugin-api) version 1.0.13 and earlier. Users running Grav with these plugin versions are at risk. The issue is present in the standard Grav distribution under the getgrav:grav package.

The vulnerability carries a CVSS score of 9.3, indicating a high‑severity flaw. No EPSS score is available, and it is not yet listed in the CISA KEV catalog, so the current exploitation probability is unknown. Attackers need only a valid, scoped API key issued by a privileged account; no additional privileges are required. Once authenticated, the attacker can access admin‑level UI metadata over the network without further exploitation steps, enabling the theft of privileged configuration and guidance data that could support subsequent attacks.