The real story of CVE-2026-72829 isn't the 9.8 CVSS score—it's the architectural pattern of parallel authorization checks that most access control reviews miss entirely. This is a systemic failure, not a one-off coding error.
The vulnerability lives in the gap between two separate defenses: a scope cap on api.users.write meant to limit what a minimally-privileged API key can do, and an isSuperAdmin() gate that controls who can grant super-user privileges. The second check reads directly from access.api.super without consulting the scope context that the first check enforces. This is the kind of flaw that passes code review because it's not a missing check—it's an inconsistent check across two parallel authorization paths that nobody connected.
The attack chain is more nuanced than simple privilege escalation. An attacker with a minimally-scoped API key (api.users.write on a super account) uses that key to promote another account to super privileges, then authenticates as that account. The forensic trail shows legitimate API activity by a legitimately-scoped key performing account operations within the apparent bounds of that scope. Your SIEM sees authenticated calls, valid keys, and authorized methods—it cannot see that "modify a user" should be impossible when that user is a super account. That's a semantic question, not a syntactic one, and most detection pipelines aren't built for semantic analysis.
Check your audit logs for account modification events regardless of key scope—it's the only place this promotion will surface. Beyond patching, audit your codebase for other instances where scope checks and privilege gates run in parallel without consulting each other. The isSuperAdmin() pattern may exist elsewhere, and the scope system may need a full audit against every pre-existing authorization gate, not just this UsersController method. If this gap emerged from refactoring at different times, other parallel-check patterns are likely lurking as undiscovered debt.