CVE-2026-80203

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.18

Description The getgrav/grav-plugin-api plugin fails to enforce API-key scope within the requireNotSuperTarget() function located in UsersController.php across seven sensitive user-management endpoints. The system incorrectly uses isSuperAdmin() to check the acting account instead of verifying if the specific API key possesses super authority through isSuperWithinScope(). This allows an API key with limited scope, if it belongs to a super-admin account, to perform unauthorized actions against other super-admin accounts, such as disabling two-factor authentication (2FA), deleting avatars, creating new API keys under their identity, or deleting existing API keys.

Recommendations Update getgrav/grav-plugin-api to version 1.0.18 or later.