The Grav API plugin prior to version 1.0.14 fails to enforce the authorize requirement for menubar actions. While the endpoint that lists menu items filters items through userPassesAuthorize(), the POST endpoint for executing actions only checks that the caller has the generic api.access permission and ignores the plugin‑specific authorize flag. This flaw allows an authenticated user who possesses api.access to invoke any registered menubar action, bypassing the intended authorization checks. The immediate effect is that privileged operations may be triggered without the proper grants, potentially leading to unauthorized configuration changes or disclosure of sensitive data if a plugin registers privileged handlers.

The affected product is the Grav API plugin bundled with Grav's admin-next/API stack, produced by getgrav. Versions of the plugin older than 1.0.14 are vulnerable. The flaw also applies to any first‑ or third‑party plugin that registers a menubar action and relies on the documented authorize semantics, even though the core Grav release does not ship such privileged handlers currently.

The CVSS score of 8.7 classifies this as a high severity vulnerability. The EPSS score is not available, so the exact likelihood of exploitation is unknown, but the fact that it can be triggered by any authenticated user with api.access increases its practical risk. It is not listed in CISA's KEV catalog. Attackers can exploit the flaw by authenticating, assigning themselves or utilizing an account with api.access, then calling the vulnerable POST endpoint to execute privileged menubar actions. No special privileges are required beyond api.access, so the range of affected users is potentially large if api.access is widely granted.