API-key scope cap bypass in Grav API plugin UsersController (CVE-2026-72829)

The Grav API plugin's UsersController create() and update() methods enforce the scope cap only for api.users.write but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. An api.users.write-scoped key minted on a super account can therefore set access.api.super or assign a super-granting group, minting or promoting a full super account and enabling authentication with uncapped administrative privileges. This privilege escalation can chain to remote code execution via the scheduler-config write path. Affected versions: - <= 1.0.12 We recommend updating to: 1.0.13. CVSS 9.3 · our assessment: act_now Reference: https://github.com/getgrav/grav/security/advisories/GHSA-jrm3-jpp7-3gmx Details: https://vuln.today/cve/CVE-2026-72829