CVE-2026-72825
Received Received - Intake

Stored XSS in Grav CMS via API Key Scope Bypass

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of requireSuper(). Because isSuperAdmin() reads access.api.super directly and never consults api_key_scopes, a least-privilege API key scoped to api.config.write minted on a super account passes the gate, allowing an attacker to append attacker-chosen tokens to the security.twig_sandbox allowlist (persisted to user/config/security.yaml). Widening the allowlist turns any subsequent Twig-in-content render into an SSTI/RCE sink.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72825
EUVD
EUVD-2026-58639

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav to 1.0.13 (exc)
getgrav grav-plugin-api to 1.0.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72825 is a vulnerability in the Grav CMS plugin grav-plugin-api affecting versions up to 1.0.12. It allows an attacker to bypass API-key scope restrictions in the ReportsController endpoint /reports/twig-content/allowlist. The issue occurs because the endpoint uses a weak isSuperAdmin() check instead of requireSuper(), letting least-privilege API keys with api.config.write scope on super accounts bypass intended restrictions. This enables appending malicious tokens to the Twig sandbox allowlist, which can lead to Server-Side Template Injection (SSTI) or Remote Code Execution (RCE).

Detection Guidance

Check Grav plugin versions with: composer show getgrav/grav-plugin-api. If version <=1.0.12, the system is vulnerable. Inspect user/config/security.yaml for unexpected entries under security.twig_sandbox.allowlist. Monitor POST requests to /reports/twig-content/allowlist for unauthorized modifications.

Impact Analysis

An attacker could exploit this to gain control over a Grav CMS instance by executing arbitrary code. This could lead to data theft, website defacement, or further compromise of the server hosting the CMS. The attack requires minting a specific API key and sending a crafted request, making it feasible for remote attackers with low privileges.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations using affected Grav CMS versions may face compliance violations, data breach notifications, and potential fines if exploited.

Mitigation Strategies

Upgrade grav-plugin-api to version 1.0.13 or later immediately. Review and remove any unauthorized entries in user/config/security.yaml under security.twig_sandbox.allowlist. Rotate all API keys, especially those with api.config.write scope on super accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72825. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart