CVE-2026-72824
Received Received - Intake

Grav API Plugin Server-Side Template Injection via API Key Scope Bypass

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check uses a bare isSuperAdmin() gate that does not consult api_key_scopes, so a least-privilege API key scoped only to api.pages.write and minted on a super account can enable process.twig on a page save even though admin.pages_twig is intentionally outside the api.pages scope. When security.twig_content.process_enabled=true and editor_enabled=false, this allows Twig-in-content to execute server-side, resulting in server-side template injection (SSTI) and remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72824
EUVD
EUVD-2026-58638

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
getgrav grav-plugin-api to 1.0.13 (exc)
getgrav grav From 0 (inc) to 1.0.13 (exc)
getgrav grav_plugin_api to 1.0.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72824 is an API key scope bypass in the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.13. It allows a least-privilege API key, scoped only to api.pages.write and created on a super account, to bypass intended restrictions and enable process.twig during page saves. This occurs because the guardTwigContent() function uses a bare isSuperAdmin() check that does not consult api_key_scopes. When security.twig_content.process_enabled=true and editor_enabled=false, this enables server-side template injection (SSTI) and remote code execution.

Detection Guidance

Check Grav plugin version with: composer show getgrav/grav-plugin-api. If version is <=1.0.12, the system is vulnerable. Inspect PagesController::guardTwigContent() for isSuperAdmin() usage without api_key_scopes checks. Verify security.twig_content.process_enabled=true and editor_enabled=false in Grav config.

Impact Analysis

An attacker could exploit this to execute arbitrary server-side code on a vulnerable Grav instance. This could lead to full system compromise, data theft, or unauthorized access to sensitive information. The impact is severe due to the potential for remote code execution, especially if the Grav instance is exposed to untrusted networks or users.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. If exploited, it may result in data breaches, unauthorized data processing, or loss of data integrity, all of which are non-compliant with these regulations. Organizations using vulnerable Grav instances may face legal penalties and reputational damage.

Mitigation Strategies

Upgrade grav-plugin-api to version 1.0.13 or later immediately. Disable Twig processing by setting security.twig_content.process_enabled=false in Grav configuration. Review and restrict API key scopes to minimum required permissions. Monitor for unauthorized page saves or template modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72824. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart