The vulnerability in grav‑plugin‑api before version 1.0.20 allows privilege escalation because the stripSuperFlags() method fails to remove dot‑keyed super flags such as api.super, a flaw that aligns with CWE‑269 Access Control weaknesses. A non‑super user manager who possesses api.access and api.users.write permissions can create a crafted invitation containing a dot‑keyed super flag. When the invitation is accepted, the flag bypasses the guard and persists in the new account, enabling an attacker to obtain a super‑admin role and generate a valid JWT for full site control.

Grav CMS installations that use getgrav’s grav‑plugin‑api plugin in versions 1.0.0 through 1.0.19 are affected. The vulnerability is fixed in version 1.0.20 and later.

The CVSS base score is 8.7, indicating high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack path involves submitting a crafted invitation via the public invitation acceptance endpoint; this public API endpoint allows an attacker to create a super‑admin account and immediately acquire a valid JWT. The likely vector is the web interface, and the risk of exploitation remains significant until the plugin is updated.