The Grav API Plugin’s UsersController::createApiKey lacks a check for super access rights, letting an ordinary user with api.users.write permission generate an API key that binds to an access.api.super target. Because API key scopes are not enforced, the key grants full super‑administrator privileges and can also be used to remove or rotate two‑factor authentication for the target account. The resulting impact is the creation of persistent, unrestricted super‑admin access for the attacker.

All Grav CMS installations running Grav API plugin older than version 1.0.6 are affected. The vulnerability is present in the getgrav:grav-plugin-api package before the 1.0.6 release. Users of earlier releases should verify their current API plugin version and update accordingly.

The CVSS score of 8.8 indicates high severity. The EPSS score of < 1% suggests a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a REST‑API call to /api/users/createApiKey by an authenticated user who has the api.users.write scope. Successful exploitation results in super‑administrator privileges and the ability to compromise the entire site.