The Grav API plugin (getgrav/grav-plugin-api) prior to version 1.0.14 fails to enforce authorization requirements in the MenubarController::executeAction() method. Specifically, the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only verifies the baseline api.access permission but does not check the 'authorize' field that plugins may register for actions. This allows any authenticated user with api.access permission to bypass intended authorization controls and invoke privileged menubar actions directly. The GET /menubar/items endpoint correctly filters items based on authorization, but the POST endpoint does not. Although no core Grav plugins currently register privileged authorize handlers, third-party or custom plugins relying on this authorization mechanism are vulnerable.

Authenticated users with the baseline api.access permission can bypass intended authorization controls on privileged menubar actions via the POST endpoint. This could allow unauthorized execution of privileged actions in plugins that rely on the authorize semantics. On a default Grav installation, the impact is latent since no core plugins register privileged authorize handlers. However, any first- or third-party plugin that depends on these authorization checks is affected, potentially leading to unauthorized privileged operations.

Upgrade the Grav API plugin to version 1.0.14 or later, where this authorization enforcement issue is fixed. Until then, restrict api.access permissions to trusted users only. Review any third-party or custom plugins that rely on the authorize semantics for menubar actions and apply additional access controls if upgrading is not immediately possible.