CVE-2026-62666 is a privilege escalation in Grav CMS's API plugin (versions prior to 1.0.6) where three endpoints—createApiKey, generate2fa, and disable2fa—fail to invoke the accessGrantsSuper() authorization guard that correctly exists in sibling methods within the same controller. This is not a case of a developer unfamiliar with the security model; the correct pattern is visible a few lines away in parallel methods. The clustering of the identical flaw across three distinct endpoints points to a copy-paste development pattern where business logic was copied but the authorization guard was silently omitted. This is a cognitive failure under high implementation load, not a knowledge gap—the developer was managing what each endpoint does, how parameters flow, and response formatting, leaving the authorization check as a casualty of context switching between methods.
The more dangerous vulnerability is the second-stage failure: scope validation is absent from the authentication pipeline entirely. Even after bypassing the accessGrantsSuper() check, privilege escalation succeeds because requireApiKeyPermission() does not enforce the scopes declared for a key. This means a non-super user who bypasses the target check can mint an API key that binds itself to arbitrary privileges—and this key persists in the database until explicitly rotated, unlike session tokens that expire. The combination of two individually modest gaps creates a permanent backdoor.
Verify your deployment: confirm you are running API plugin version 1.0.6 or later. Check whether the three reported endpoints now correctly invoke accessGrantsSuper() in their method bodies. More critically, determine whether the 1.0.6 patch addresses only these three methods or whether it also hardens requireApiKeyPermission() to enforce scope declaration at the pipeline level. If the fix is narrowly scoped to the three endpoints, the same architectural gap persists in every future endpoint that mutates user state—the vulnerability class remains open. The EPSS score of 0.00426 reflects low active exploitation, but the real risk is structural: in CMS plugin ecosystems, authorization is often treated as optional scaffolding rather than inherited policy, and disclosed vulnerabilities in narrow patches accumulate as systemic debt when the underlying architecture is not corrected.