Privilege Escalation in Grav grav-plugin-api

The Grav grav-plugin-api plugin, in versions prior to 1.0.36, contains a privilege escalation vulnerability that stems from improper validation of admin or API parent grants. Attackers who possess the 'api.users.write' permission can modify account access maps or invitations. By manipulating these structures to include positive scalar values, an attacker can coerce the permission resolver to incorrectly satisfy 'requireSuper' authorization checks. This flaw allows a standard user manager to elevate their privileges to that of a super-admin, granting them access to restricted API endpoints that should be protected. This vulnerability poses a significant risk to the integrity and confidentiality of the Grav management interface, as it allows for unauthorized administrative control over the application.

Impact

Successful exploitation allows a user with existing, limited 'api.users.write' permissions to escalate their account status to a super-admin level. This provides complete control over the Grav instance's API, potentially leading to unauthorized data exfiltration, system configuration changes, or the compromise of all hosted content. Organizations using the Grav CMS with the affected plugin are vulnerable if they have delegated user management responsibilities to non-administrative accounts.

Recommendation

• Patch the Grav grav-plugin-api plugin by upgrading to version 1.0.36 or later immediately.
• Audit existing user accounts and access maps for unauthorized modification or suspicious assignment of 'admin' or 'api' parent grants.
• Restrict 'api.users.write' permissions to only the most trusted administrative accounts until the upgrade is applied.