If you're running Grav CMS with the admin plugin and API support, this CVE deserves attention even though the EPSS score is negligible. The vulnerability is a principal-confusion flaw: a super-admin account that issues a scoped API key (api.users.write) can use that restricted token to create an invitation that embeds super-admin flags, which are then written verbatim when the invitation is accepted. The scope system and the user-role system were never designed to compose this way — the API key inherits the creating account's identity rather than establishing an independent token principal, and the invitation acceptance logic trusts the payload without re-evaluating whether the creator had authority to embed those flags. This is the exact pattern that makes principal-confusion vulnerabilities insidious: no check is missing, the wrong check runs in the wrong trust domain.
What you should do: First, audit your Grav instances for super-admin accounts that have issued API keys with api.users.write scope — this is the exact starting condition the exploit requires, and it's a documented best practice for automation scenarios, which means it's plausible in your environment. Second, review your invitation acceptance logs for any correlation between API key scope and invitation payload flags — standard SIEM rules won't catch this because the invitation record looks identical whether created legitimately or exploitatively. Third, verify you're on plugin version 1.0.13 or later; the fix presumably enforces scope-aware checks at both invitation creation and acceptance, treating data produced in an elevated context as untrusted when consumed in a different authorization context.
The deeper lesson is architectural: scope systems often function as compliance theater — developers add api.users.write and mentally map it to 'this key can manage users' rather than 'these specific operations with these specific constraints.' The invitation acceptance path is exactly the kind of forgotten transitional code that sits at a trust boundary and receives no security attention because everyone assumes it's dead weight. Every organization with a super account and API automation is carrying this exposure right now, and the EPSS score systematically underestimates it because the model assumes high-skill exploit requirements that don't match a curl command with a valid API key.