API key scope escalation in Grav CMS plugin API (CVE-2026-72826)

The getgrav/grav-plugin-api plugin does not validate that scopes assigned to a newly created API key are a subset of the requesting caller's own scopes. An attacker with a minimal api.access-scoped key on a super account can submit an empty scopes array to mint a full-access, unscoped super key, bypassing all scope restrictions. This can be further chained to achieve remote code execution via configuration write operations. Affected versions: - <= 1.0.12 We recommend updating to: 1.0.13. CVSS 9.3 · our assessment: act_now Reference: https://github.com/getgrav/grav/security/advisories/GHSA-95v9-4fcj-96gh Details: https://vuln.today/cve/CVE-2026-72826