CVE-2026-72833

The CVE identifies a privilege escalation in Grav's API plugin where four endpoints use `isSuperAdmin()` to bypass permission scoping entirely — read-only API keys can perform write actions if the underlying account has super-admin privileges. The 8.8 CVSS is accurate, but the real exposure isn't the four controllers; it's the parallel authorization architecture that allowed this pattern to exist at all. These endpoints were almost certainly gated only by `isSuperAdmin()` when the plugin was admin-only, and `requirePermission()` was bolted on later for API key scoping. The early-return pattern isn't negligence — it's a legacy migration artifact common to systems that add capability-based authorization after identity-based gates are already entrenched. The 1.0.13 patch adds `requirePermission()` calls to the four known endpoints, which closes the immediate bypass but leaves the broader architectural problem untouched: `isSuperAdmin()` still executes as a parallel gate elsewhere in the plugin, and the underlying authorization paradigm collision — identity checks versus capability assertions — remains unresolved. More critically, the EPSS of 0.00261 measures external exploitation, not credential-valid exploitation. A read-only key minted against a super-admin account before patching is still a valid credential that can now be tested against the same system it was issued for. Organizations should treat every pre-1.0.13 scoped key on super-admin accounts as compromised infrastructure and rotate them. The plugin's authorization layer needs a structural fix — `isSuperAdmin()` should either enforce scope checks or be deprecated with architectural signals preventing future use, not patched case-by-case.

Reviewed through automated stages and approved by a human before publication.