The Grav API plugin prior to version 1.0.15 contains a missing authorization vulnerability in the BlueprintPathResolver::resolveUserScope() method. This method gates access to the users/<name> scope based on the raw super-admin ACL flag (access.api.super) of the account rather than validating the API key's actual scope. Consequently, an attacker possessing an API key limited to api.media.write but created on a super-admin account can bypass authorization checks. This enables the attacker to write files into another user's scope within the shared user/accounts/ directory (restricted to image extensions) via POST /blueprint-upload and to browse that user's file listings via GET /blueprint-files, even though the key does not have api.users.write permission.

An attacker with an API key scoped only to api.media.write but minted on a super-admin account can bypass authorization controls to write files into other users' scopes and browse their file listings. This unauthorized file write and directory browsing could lead to unauthorized data exposure or manipulation within the shared user/accounts/ directory. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available in Grav API plugin version 1.0.15. Users should upgrade to version 1.0.15 or later to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official patch.