CVE-2026-80203: Incorrect Authorization in getgrav grav

The vulnerability in getgrav/grav-plugin-api plugin versions prior to 1.0.18 involves improper authorization checks in the requireNotSuperTarget() function within UsersController.php. Instead of verifying whether the API key itself has super-admin scope via isSuperWithinScope(), the code checks if the acting account is a super-admin using isSuperAdmin(). This logic flaw permits an API key scoped below full super authority, but linked to a super-admin account, to execute privileged operations on other super-admin accounts. These operations include disabling two-factor authentication, deleting avatars, minting new API keys under another user's identity, and deleting existing API keys, thereby compromising user management security.

An attacker possessing an API key with limited scope but associated with a super-admin account can abuse this vulnerability to perform unauthorized administrative actions on other super-admin accounts. This includes disabling their two-factor authentication, deleting their avatars, creating new API keys impersonating them, or deleting their existing API keys. Such actions can lead to account takeover, privilege escalation, and loss of account integrity for super-admin users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.0.18, upgrading to version 1.0.18 or later is likely the intended remediation once available. Until then, restrict API key issuance and monitor for suspicious activity related to super-admin accounts. Avoid using API keys with super-admin privileges unless absolutely necessary.