Grav API Plugin EUVD-2026-58637

Two simultaneous non-default conditions must be satisfied. First, the attacker must hold a valid API key that was minted specifically on a super admin account - this implies either legitimate access to such a key, prior compromise of credentials, or insider threat. Second, the target Grav installation must have demo mode actively configured with writable resources enabled, which is a non-default setup not present in standard production deployments. Exploitation is strictly scoped to the DemoController endpoints (baseline() and reset(), e.g., POST /api/v1/demo/reset) and cannot be leveraged to access user data, file system resources outside demo scope, or administrative configuration. Grav instances without demo mode configured are completely unaffected regardless of API key configuration.

The provided CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N) reflects network-accessible exploitation with low-privilege authentication and limited impact. However, AT:N (no attack requirements) understates the real-world constraint: demo mode with writable resources must be enabled, which is a non-default production configuration. Adjusting for this, the practical exploitable population is substantially smaller than the raw score suggests. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, confirming no confirmed active exploitation. The integrity and availability impacts are confined to demo-engine operations with no confidentiality exposure and no subsequent-system impact. This is not a high-priority remediation for standard production Grav deployments without demo mode; operators running demo instances with writable resources should treat it as elevated priority. The combination of required super-account API key issuance plus non-default demo mode makes opportunistic mass exploitation implausible.

An attacker who has been issued a scoped API key tied to a super admin account - or who has obtained such a key through credential theft or insider access - sends POST /api/v1/demo/reset to a Grav instance running in demo mode with writable resources. The requireSuper() guard confirms super admin status and returns without calling requirePermission(), so the key's scope restrictions are never evaluated and the reset executes. The demo environment is forced into a reset or its baseline state is captured, potentially disrupting demo workflows or exposing baseline configuration data depending on what the demo mode holds.