API-key scope cap bypass in Grav API plugin enabling RCE (CVE-2026-72830)

The Grav API plugin's `ConfigController` enforces the API-key scope cap in only one location (`AbstractApiController::requirePermission()`), which is bypassed by super-scope gates that rely on a bare `isSuperAdmin()` check and never consult `api_key_scopes`. A scoped `api.config.write` key minted on a super account therefore passes the scheduler gate, allowing an attacker to inject arbitrary commands into `scheduler.custom_jobs[].command`, which `Job::run()` feeds to a Symfony Process for remote code execution as the web/PHP user. The flaw also permits disabling rate limiting, widening CORS, and expanding the Twig sandbox via the same bypass path. Affected versions: - <= 1.0.12 We recommend updating to: 1.0.13. CVSS 9.3 · our assessment: act_now Reference: https://github.com/getgrav/grav/security/advisories/GHSA-2x29-3mjq-2pvx Details: https://vuln.today/cve/CVE-2026-72830