The Grav plugin grav-plugin-api before version 1.0.13 fails to verify that the scopes of a newly created API key are limited to a subset of the caller’s scopes when createApiKey is called. The call requires only the baseline api.access scope, and the new key’s scopes are taken directly from the request body with no subset check. An attacker who possesses a minimal‑scope key on a super account can issue a request with an empty scopes array and receive an unscoped, full‑access super key, thereby bypassing all scope restrictions. This flaw, classified as CWE‑266, enables the attacker to gain unrestricted access to the Grav system, potentially allowing subsequent configuration writes that could lead to remote code execution.

The vulnerability affects installations of the getgrav Grav CMS that use the grav-plugin-api plugin prior to release 1.0.13. Any version earlier than 1.0.13 is vulnerable, including all 1.0.x builds up to 1.0.12 and earlier releases.

The CVSS score of 8.7 indicates a high severity. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker with a minimal‑scope API key on a super account submitting a createApiKey request with an empty scopes array; the endpoint requires only the baseline api.access scope, allowing the attacker to create an unrestricted key and thereby elevate privileges.