Grav API Plugin EUVD-2026-60596

Exploitation requires the attacker to already possess a valid Grav API key that was minted on an account carrying the super-admin ACL flag (access.api.super), even though the key itself is scoped only to api.media.write. The vulnerable code paths are the plugin's POST /blueprint-upload (write) and GET /blueprint-files (enumerate) endpoints, so the API plugin must be installed and reachable. Limiting factors that reduce real-world risk: (1) a pre-existing scoped API key on a super-admin account is mandatory - this is not exploitable by a fully anonymous attacker despite the input's PR:N; (2) file writes are constrained by assertSafeExtension() to image extensions within the shared user/accounts/ directory, preventing direct overwrite of arbitrary config/YAML; (3) impact is bounded to cross-scope file write of image files and file-listing disclosure unless further chained.

The vendor-supplied CVSS 4.0 vector (9.3, AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) overstates real-world risk on two points that must be flagged rather than accepted as fact. First, PR:N conflicts directly with the description: exploitation requires the attacker to already hold a valid API key (scoped api.media.write) minted on a super-admin account, so a privilege/authentication prerequisite clearly exists - this should be treated as an authenticated, privilege-escalation-style flaw, not an unauthenticated one. Second, the H/H/H impact appears inflated because writes are constrained by assertSafeExtension() to image extensions in user/accounts/ and the confidentiality gain is a file listing, not arbitrary read; true impact is more limited unless a chained technique (e.g., leveraging a written image as a stored payload) is demonstrated. EPSS is not provided, there is no KEV listing, and no POC is referenced, so exploitation probability is currently low-to-unquantified. Net: for any organization actually running the Grav 2.0 API plugin with multiple keys of differing scope on super-admin accounts, this is a genuine privilege-boundary failure worth prompt patching, but it is not a mass-exploitable unauthenticated RCE and should be prioritized as high-but-conditional rather than emergency internet-wide risk.

An attacker (or a low-trust integration) is issued an API key intended only for media uploads (api.media.write) on a Grav instance where that key was minted on a super-admin account. Because the plugin authorizes against the account's super-admin flag rather than the key's scope, the attacker sends POST /blueprint-upload to write an image file into another user's user/accounts/ scope and issues GET /blueprint-files to enumerate that scope's contents - actions their key was never granted. No public POC is currently identified, but the attack is low-complexity given a valid scoped key.