The Grav API plugin before 1.0.13 contains an authorization bypass vulnerability in its DemoController. The requireSuper() method checks if the user is a super admin and returns early without invoking requirePermission(), which enforces API key scope restrictions. Consequently, scoped API keys created for super accounts can bypass their scope limitations when invoking baseline() and reset() operations. This flaw allows an attacker with such an API key to capture the demo baseline or force a demo reset. The vulnerability's impact is constrained to demo-engine control and depends on the demo mode being configured with writable resources.

An attacker possessing a scoped API key minted on a super account can bypass API key scope restrictions for certain demo-related operations. This enables unauthorized capture of the demo baseline or forced demo resets. The impact is limited to the demo engine functionality and requires the demo mode to be active with writable resources. There is no indication of broader system compromise or data exposure beyond the demo environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict issuance of API keys to trusted super accounts only and consider disabling demo mode or limiting writable resources in the demo configuration to reduce risk.