The Grav API plugin before version 1.0.14 contains a missing authorization vulnerability in the userPassesAuthorize() function within AbstractApiController.php. This function fails to verify the calling request's API key scopes and instead bases authorization decisions on the account's raw super-admin flag and ACL grants. Consequently, an attacker authenticated with a scoped API key minted on a privileged account can circumvent scope restrictions to access authorize-gated UI metadata and item definitions, including sidebar, menubar, widget items, and users-list columns, row actions, and filter tabs. This results in unauthorized information disclosure.

An authenticated attacker possessing a scoped API key derived from a privileged account can bypass intended scope restrictions. This allows unauthorized access to sensitive UI metadata and item definitions that should be protected, resulting in information disclosure. The vulnerability does not require privilege escalation or user interaction but does require authentication with a scoped API key.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, restrict API key issuance to trusted users and minimize the privileges granted to API keys to reduce exposure.