The Grav API plugin (getgrav/grav-plugin-api) prior to version 1.0.14 fails to enforce authorization requirements in the MenubarController::executeAction() method for POST requests to /api/v1/menubar/actions/{plugin}/{action}. Although the GET /menubar/items endpoint correctly filters items based on user authorization, the POST endpoint only checks for the baseline api.access permission and ignores the authorize field registered by plugins for specific actions. Consequently, any authenticated user with api.access permission can bypass intended authorization controls and invoke privileged menubar actions directly. No core Grav plugins currently register privileged authorize handlers, so the vulnerability's impact is latent on default installations but affects any first- or third-party plugins that rely on the documented authorization semantics.

An authenticated user with the baseline api.access permission can bypass intended authorization checks and invoke privileged menubar actions directly via the vulnerable POST endpoint. This could lead to unauthorized execution of privileged actions in plugins that rely on the authorization mechanism. On stock Grav installations, the impact is latent because no core plugins register privileged authorize handlers. However, any custom or third-party plugins that implement privileged authorize handlers are vulnerable to unauthorized access and potential privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict api.access permissions to trusted users only to limit exposure. Monitor vendor communications for updates regarding patches or official fixes addressing this authorization bypass vulnerability.