CVE-2026-80203 in API Plugin
Summary
by MITRE • 08/26/2026
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in the getgrav/grav-plugin-api plugin prior to version 1.0.18 represents a critical failure in access control logic within the user management subsystem. Specifically, the flaw resides in the requireNotSuperTarget function located in UsersController.php. This function is invoked across seven distinct endpoints responsible for sensitive user operations, including actions that modify authentication settings and identity attributes. The core technical deficiency lies in how the plugin validates authorization privileges when a request originates from an API key interface. Instead of inspecting the specific permissions granted to the API key being used for the current operation, the system erroneously relies on checking whether the account associated with that API key holds super-administrator status globally via the isSuperAdmin method. This architectural oversight creates a significant discrepancy between the identity of the user and the actual scope of authority possessed by the credential initiating the request.
This misalignment in authorization logic allows for severe privilege escalation scenarios where an attacker possessing a limited-scope API key can perform actions reserved exclusively for super-administrators, provided that the owner account has elevated privileges. For instance, if an organization grants a developer or service account an API key with restricted permissions scoped to specific non-sensitive resources, but assigns that same user identity super-administrator status in the backend system, any action taken using that limited-key will be processed as if it were executed by a full super-administrator. Consequently, the security boundary intended by the scope definition is effectively bypassed because the validation mechanism ignores the granular constraints of the API key itself. The vulnerability essentially treats all actions from an account with high-level privileges as unrestricted, regardless of the specific capabilities declared in the token used for authentication.
The operational impact of this flaw is substantial and directly compromises the integrity and security posture of Grav-based websites that utilize this plugin. An attacker exploiting this issue can disable two-factor authentication on other super-administrator accounts, thereby removing a critical layer of defense against unauthorized access. Furthermore, the vulnerability permits the deletion or modification of user avatars, which may impact organizational branding or identity verification processes. More critically, it allows for the minting of new API keys under the guise of another super-administrator and the subsequent deletion of existing valid API keys belonging to those accounts. This capability enables an attacker to establish persistent backdoor access by creating their own high-privilege credentials while simultaneously disrupting legitimate administrative operations through key removal, effectively locking out other administrators or facilitating further lateral movement within the system.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, as it involves granting elevated privileges to an actor that should not possess them based on their specific credentials. It also maps closely to CWE-862, Missing Authorization, because the application fails to enforce proper access control checks for API key scopes before allowing sensitive operations. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior is consistent with T1078 Valid Accounts and potentially T1556 Modifying Authentication Process if used to disable 2FA. The exploitation vector typically involves crafting authenticated HTTP requests using a compromised or low-privilege API key associated with an admin account, targeting the specific endpoints in UsersController.php that trigger the flawed requireNotSuperTarget logic.
To mitigate this vulnerability, organizations must immediately upgrade the getgrav/grav-plugin-api plugin to version 1.0.18 or later, where the developers have corrected the authorization check to properly verify if the API key itself possesses super authority using isSuperWithinScope rather than relying on account-level status. Until an update can be applied, administrators should review their user roles and ensure that no accounts with high-privilege scopes are assigned low-scope API keys for critical operations. Additionally, implementing strict input validation and ensuring that all sensitive endpoints enforce scope-specific checks at the controller level is essential to prevent similar logic flaws in other parts of the application ecosystem. Regular auditing of API key permissions against actual user roles can help identify potential misconfigurations before they are exploited by malicious actors seeking to escalate privileges or disrupt administrative functions.