The Grav API plugin before 1.0.13 contains an improper privilege management vulnerability in the UsersController's create() and update() methods. These methods enforce scope caps only for api.users.write but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the API key's scopes. Consequently, an api.users.write-scoped key minted on a super account can set access.api.super or assign a super-granting group, effectively promoting itself to a full super account and gaining uncapped administrative privileges.

An attacker with an api.users.write-scoped API key minted on a super account can escalate privileges to full super-administrative level. This allows unauthorized modification of access controls, including setting super privileges or assigning super-granting groups, leading to complete compromise of administrative functions within the Grav system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict issuance of api.users.write-scoped API keys on super accounts and monitor for suspicious privilege escalations.