CVE-2026-72823

This vulnerability is not about demo engine manipulation. It is a complete failure of API key scope enforcement on privileged accounts that fundamentally undermines the trust model of the entire API key system. The technical mechanism: the `requireSuper()` method returns early before ever reaching `requirePermission()`, where the `api_key_scopes` check lives. When a scoped API key is derived from a super admin account, its declared restrictions are silently bypassed — the scope restriction becomes theater. Any key minted from a super account can discard its own declared limitations because the enforcement path for super users explicitly diverges from the enforcement path for scoped keys. The CVSS 5.4 rating obscures the real risk. While an attacker with super admin access already has significant power, the vulnerability poisons every downstream consumer of scoped keys: multi-tenant integrations, delegated third-party access, compliance logging that relies on scope labels for attribution. An organization relying on scoped keys for multi-tenant isolation has no way to know their trust model is broken. The demo engine is merely the vector; the vulnerability is the mechanism by which any scope restriction can be discarded. The detection gap is structural, not circumstantial. Telemetry treats every super admin call as legitimate by design — the system was architected to treat super account actions as inherently trustworthy. There is no audit event for a scope bypass because the bypass is invisible to the authorization path. If you later discover exploitation, you cannot determine which scoped keys were misused; incident response collapses into rotating every key minted from every super account across every tenant. What you should do: audit your super admin accounts and the scoped keys generated from them. Treat any pre-existing scoped key derived from a super account as potentially untrusted. Implement secondary authorization checks that validate scope constraints independently of the super account path. The fix must go beyond patching the demo controller — the architectural disconnect between `requireSuper()` and `requirePermission()` is the actual vulnerability.

Reviewed through automated stages and approved by a human before publication.