The Grav CMS plugin 'grav-plugin-api' contains a flaw where the API-key scope check is not applied during permission editing. An attacker who holds a scoped API key could view and potentially modify permission fields for pages beyond the key’s intended scope. This could allow unauthorized changes to access controls, enabling further privilege escalation or content tampering within the site.

Affected are installations of Grav CMS running any version prior to 1.0.18 that use the grav-plugin-api. When the plugin is active, the vulnerability can be triggered from any authenticated API endpoint that processes page security blueprints. The vendor listed is getgrav, with product Grav, and the fix is available in release 1.0.18.

The CVSS score of 9.3 places this issue in the ‘Critical’ range, demonstrating a significant potential impact. The EPSS score is not available, so the exact likelihood of exploitation in the wild is unknown, but the high severity suggests attackers could attempt exploitation soon. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector involves an attacker sending HTTP requests to Grav’s API endpoints using a scoped API key, leveraging the unbounded permission editing capability. Because the flaw bypasses permission checks at runtime, exploitation requires only the presence of a valid API key and network access to the API.