Grav CMS API Plugin Privilege Escalation via API Key Scope Bypass

Technical Analysis

The vulnerability resides in the createApiKey function of grav-plugin-api, where requireApiKeyPermission() only checks for the baseline api.access scope on self-targeted requests rather than validating that the new key's requested scopes are a subset of the caller's existing scopes. Because the scopes array for the new key is read directly and unvalidated from the request body, an attacker can submit an empty array to generate a key that defaults to unrestricted, full super-account access. This unscoped key can then be used to write to Grav's configuration files, enabling a well-known chain to remote code execution (RCE) on the host. Organizations that run Grav CMS as a backend for content delivery, documentation, or RAG data sources feeding AI agents are at risk: a compromised host could allow attackers to exfiltrate embedded API keys, poison RAG content pipelines, or pivot to other agent tooling connected to the same infrastructure.

Affected Systems

getgrav/grav-plugin-api versions prior to 1.0.13, running on any Grav CMS deployment with the API plugin enabled and API key authentication configured

Indicators of Compromise

• No specific IOCs published at this time; monitor for anomalous POST requests to /api/... endpoints for createApiKey with empty or missing scopes arrays
• Unexpected creation of new super-scoped API keys in Grav admin panel/API key logs
• Unauthorized modifications to Grav configuration files (e.g., system.yaml, plugins config)

Remediation Steps

1. 1

   Upgrade plugin

   Update grav-plugin-api to version 1.0.13 or later, which enforces proper subset validation of API key scopes during creation.

2. 2

   Audit existing API keys

   Review all currently issued API keys for unexpected super-account or overly broad scopes, and revoke any suspicious or unrecognized keys.

3. 3

   Restrict API key issuance

   Limit which accounts/roles can create new API keys and enforce least-privilege scope assignment at the application or reverse-proxy layer as a compensating control until patched.

4. 4

   Monitor configuration changes

   Implement file integrity monitoring on Grav configuration files to detect unauthorized writes that could indicate exploitation of the RCE chain.

5. 5

   Rotate credentials

   Rotate any API keys, secrets, or credentials that may have been exposed if the vulnerability is suspected to have been exploited, especially those used by connected agent or automation systems.