Beveiligingsadvies

CVE-2026-80203

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-08-26 10:28:12

Laatst bijgewerkt 2026-08-28 22:48:35

Toegewezen door VulnCheck

CVSS-score 9.8

Status PUBLISHED

Beschrijving

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.

← Alle CVE's bekijken Bekijk op cve.org ↗