CVE-2026-72829

Name of the Vulnerable Software and Affected Versions Grav API plugin (getgrav/grav-plugin-api) versions prior to 1.0.13

Description An API-key scope-cap bypass exists in the create() and update() methods of the UsersController. While these methods enforce scope caps for api.users.write, they rely on a basic isSuperAdmin() check that reads access.api.super directly without verifying the key's scopes. This allows a key with api.users.write scope, created from a super account, to set access.api.super or assign a group that grants super-privileges. Consequently, an attacker can create or promote a full super account and authenticate as that account to obtain unrestricted administrative privileges.

Recommendations Update Grav API plugin (getgrav/grav-plugin-api) to version 1.0.13 or later.