CVE-2026-80203: Grav before 1.0.18 Authentication Bypass via Scoped API Key
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.18 - Configuration
In UsersController.php in the requireNotSuperTarget() function across the sensitive user-management endpoints, enforce API-key scope by checking the API key for super authority (via isSuperWithinScope()) rather than checking only whether the acting account is a super-admin (isSuperAdmin()).
getgrav/grav-plugin-api (UsersController.php) requireNotSuperTarget() super-admin scope check = Use isSuperWithinScope() to verify the specific API key’s super authority scope instead of relying on isSuperAdmin() for the acting account
Event History
Frequently Asked Questions
Who is exposed to this issue?
Installations using getgrav/grav-plugin-api before 1.0.18 are exposed where a super-admin account has API keys scoped below full super authority. The affected behavior applies to seven sensitive user-management endpoints.
What does an attacker need to exploit it?
An attacker needs an API key that belongs to a super-admin account but is scoped below full super authority. No user interaction or additional privileges are indicated by the provided severity vector.
What actions can exploitation enable?
The scoped key can be used against other super-admin accounts to disable 2FA, delete avatars, create API keys under their identities, or delete their existing API keys.
How can I determine whether my deployment is affected?
Check whether the installed getgrav/grav-plugin-api version is earlier than 1.0.18. Also review API keys associated with super-admin accounts, particularly keys intended to have limited scope.