Grav's getgrav/grav-plugin-api before 1.0.13 fails to enforce API key scope controls in the InvitationsController. The strip-super and accept-groups actions rely solely on isSuperAdmin() rather than scope‑aware permission checks. Consequently, an API key with only api.users.write scope issued to a super‑account can create invitations that include super‑admin flags. When the invitation is accepted, those flags are written unchanged to the new account, giving the attacker full super‑account privileges. This is a classic privilege escalation vulnerability.

The affected product is Grav, provided by getgrav. All Grav installations using getgrav/grav-plugin-api versions older than 1.0.13 are vulnerable. No other vendor or version information is specified.

The CVSS score of 8.6 indicates a high‑severity flaw. EPSS data is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires the attacker to possess an API key with at least the api.users.write scope and to invoke the InvitationsController’s create or accept endpoints. The vulnerability can be triggered over the web API, so the attack vector is remote. Because the attack relies on legitimate API usage, the likelihood of exploitation is potentially moderate but depends on the frequency of low‑privilege API key usage and the presence of the vulnerable Grav version.