The Grav API plugin before version 1.0.13 has an API‑key scope‑cap bypass in the UsersController’s create() and update() methods. The controller enforces the users.write key scope on most user actions, but it performs a separate check for super‑admin privileges that reads the access.api.super flag directly, ignoring the key’s scopes. Consequently, an attacker who can obtain or forge an API key with only the users.write scope—issued by a super‑admin account—can elevate that key to super‑admin status by setting access.api.super to true or assigning the key to a group that grants super‑admin rights. This allows the attacker to gain unrestricted administrative privileges, providing full control over the Grav installation. The weakness corresponds to CWE‑269: Failure to restrict or consider privilege escalation.

Any Grav installation using the getgrav/grav-plugin-api before version 1.0.13 is affected. The vulnerability is present in every release of the plugin prior to 1.0.13, regardless of other Grav or system components. Administrators should identify if their Grav instance contains the vulnerable API plugin and whether the instance is using an API key with the users.write scope.

The CVSS score of 8.7 classifies this vulnerability as high. The EPSS score is < 1%, and the issue is not listed in the CISA KEV catalog, indicating no publicly known exploits at the time of this analysis. The likely attack vector is remote; an attacker needs an API key with users.write scope, which can be obtained through credential compromise, key disclosure, or malicious insider activity. Once the key is in hand, the attacker can remotely send API requests to the UsersController to promote themselves to super‑admin without further authentication steps. Given the high CVSS score and the ability to cause complete administrative takeover, the risk of exploitation is substantial in environments where API keys are exposed or poorly protected.