Grav CMS API Plugin API-Key Scope Bypass Privilege Escalation

Technical Analysis

CVE-2026-80203 stems from a logic flaw in the requireNotSuperTarget() function within UsersController.php, which uses isSuperAdmin() to check the acting user's account-level role rather than isSuperWithinScope() to validate the actual permission scope embedded in the API key. This means an API key intentionally scoped with reduced privileges is treated as having full super-admin authority as long as it is tied to a super-admin account, violating the principle of least privilege. The vulnerability affects seven sensitive endpoints in the user-management API, allowing actions such as disabling two-factor authentication, deleting avatars, and creating or deleting API keys for other super-admin accounts. This is a textbook broken access control (CWE-863) issue with a CVSS score of 9.8, indicating trivial exploitability and high impact once any scoped API key is compromised. Organizations that use Grav CMS to power internal documentation, knowledge bases, or content feeds consumed by AI agents and RAG pipelines should treat this as agent-relevant: a compromised low-privilege API key could be leveraged to escalate access, exfiltrate other API keys, or tamper with content that agents ingest and act upon, undermining the integrity and trust boundary of automated systems.

Affected Systems

getgrav/grav-plugin-api versions prior to 1.0.18; Grav CMS installations utilizing the API plugin for user management via API keys, particularly instances with multiple super-admin accounts and scoped API key configurations

Indicators of Compromise

• No specific IOCs published; indicators would be anomalous API calls to UsersController.php endpoints (2FA disable, avatar delete, API key create/delete) originating from unexpected or lower-privileged API key contexts

Remediation Steps

1. 1

   Upgrade the plugin

   Update getgrav/grav-plugin-api to version 1.0.18 or later, where isSuperWithinScope() is properly enforced.

2. 2

   Audit API key scopes

   Review all issued API keys tied to super-admin accounts and revoke or re-scope any keys granting broader access than necessary.

3. 3

   Monitor user-management endpoints

   Enable logging and alerting on the seven affected UsersController.php endpoints for unusual API key activity, especially 2FA changes and key creation/deletion.

4. 4

   Rotate credentials

   Rotate all API keys associated with super-admin accounts following the patch to eliminate any keys potentially abused pre-fix.

5. 5

   Apply least privilege reviews

   Regularly audit account-to-API-key privilege mappings to ensure scoped keys cannot be misused due to account-level role inheritance.