CVE-2026-72829 Grav before 1.0.13 API Key Scope Bypass via UsersController

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...