Super-admin escalation via scope-blind privilege checks

Privilege escalation in the Grav API plugin before 1.0.13 allows remote authenticated users to obtain unrestricted super-admin access. UsersController create() and update() enforce only api.users.write, while isSuperAdmin() reads account privilege without applying the key's scope cap. A key scoped to api.users.write must be minted on a super account; successful use creates or promotes an account with uncapped administrative authority.