The getgrav/grav-plugin-api plugin versions prior to 1.0.13 fail to enforce scope validation when creating new API keys. Specifically, the createApiKey function does not check that the requested scopes for the new key are a subset of the caller's scopes. The requireApiKeyPermission function only requires the baseline api.access scope for the self-target path, and the new key's scopes are taken directly from the request body without subset verification. Consequently, an attacker possessing a minimal-scope API key on a super account can submit an empty scopes array to mint an unscoped, full-access super key. This flaw enables privilege escalation and can facilitate further attacks such as configuration modification leading to remote code execution.

An attacker with minimal API key privileges on a super account can escalate their privileges to full super user access by exploiting the lack of scope validation. This effectively bypasses all scope restrictions and can lead to critical impacts including unauthorized configuration changes and potential remote code execution. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

No official patch or remediation guidance is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict API key issuance and monitor for suspicious API key creation activity. Avoid using minimal-scope API keys on super accounts where possible.