The vulnerability in the Grav platform allows an attacker who owns an API key scoped below full super authority to bypass authentication checks and perform privileged operations on other super‑admin accounts. The bug lies in the requireNotSuperTarget() function of UsersController.php, where the code verifies the acting user is a super‑admin instead of validating that the API key itself grants super‑authority via isSuperWithinScope(). As a result, an attacker can disable two‑factor authentication, delete avatars, create new API keys, or delete existing keys for other super‑admin users. This flaw is a classic example of misuse of API‑key scope, classified as CWE‑863.

The issue affects the Grav content management system, specifically the getgrav/grav-plugin-api component in versions prior to 1.0.18. Users running any Grav release that includes a grav-plugin-api version earlier than 1.0.18 are vulnerable. The plugin is distributed by the getgrav organization. The vulnerability impacts all Grav installations that expose the seven user‑management endpoints controlled by the plugin.

With a CVSS score of 9.3, this flaw represents a severe security risk. Although the EPSS score is not available, the lack of an entry in the CISA KEV list does not diminish its potential for exploitation. The likely attack vector is remote, leveraging the Grav API over HTTP or HTTPS. An attacker in possession of a low‑scope API key can construct requests to the affected endpoints and achieve full administrative control over other super‑admin accounts. Consequently, the risk level is high and remediation should be prioritized.