The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.

The getgrav/grav-plugin-api plugin before version 1.0.18 contains a critical authorization flaw in the requireNotSuperTarget() function within UsersController.php. The vulnerability affects seven sensitive user-management endpoints that fail to properly enforce API key scope. Instead of verifying whether the specific API key carries super authority via isSuperWithinScope(), the check incorrectly uses isSuperAdmin() on the acting account. This allows an API key scoped below full super authority, but belonging to a super-admin account, to perform privileged actions against other super-admin accounts. Potential impacts include disabling 2FA, deleting avatars, minting new API keys under another identity, and deleting existing API keys. The flaw represents an authentication bypass that could lead to account takeover of privileged users.