A missing authorization check in the Grav API plugin lets a scope-restricted API key enable Twig processing on page content, so a credential intended to be capability-limited can, under the right configuration, reach server-side template injection and remote code execution.
What Is It
CVE-2026-72824 is a missing authorization flaw (CWE-862) in the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.13. The Twig-toggle check inside PagesController::guardTwigContent() relies on a bare isSuperAdmin() gate that never consults api_key_scopes. The consequence is that scope restrictions do not narrow what a key can do when that key is bound to a super account: a key issued with only api.pages.write still passes the gate on the strength of the underlying account, and can flip process.twig on a page save, even though admin.pages_twig is deliberately outside the api.pages scope. Where security.twig_content.process_enabled=true and editor_enabled=false, Twig embedded in page content would then be processed server-side, opening the path to SSTI and remote code execution.
Why It Matters
The advisory rates the issue critical: the attack is carried out over the network, attack complexity is low, no user interaction is needed, and the impact is high across confidentiality, integrity, and availability. Exploitation is not unauthenticated; the attacker must hold a valid API key whose declared scope sits below the privilege the operation is supposed to require. That is precisely the point of the bug: the scope-cap model, the control administrators depend on when handing out restricted API keys, does not hold for keys attached to super accounts, and code execution on the host is the plausible end state on affected configurations. Environments that have issued scope-limited keys to integrations, contractors, or CI jobs should audit which accounts those keys were minted under, and treat any key backed by a super account as effectively unrestricted rather than capped by its stated scope.
What's Vulnerable
- Vendor: getgrav
- Product: grav (Grav API plugin,
getgrav/grav-plugin-api) - Affected: all versions before 1.0.13
- Unaffected: 1.0.13 and later
- Exploitation depends on the configuration
security.twig_content.process_enabled=truewitheditor_enabled=false, and on the API key being tied to an account theisSuperAdmin()check accepts
Patch Status
Version 1.0.13 of the plugin is marked unaffected; upgrading to 1.0.13 or later is the fix indicated by the advisory. Sites that cannot upgrade immediately should set security.twig_content.process_enabled=false, which removes the execution path this issue depends on, and rotate any API keys that may have been exposed. There is no CISA KEV entry for this CVE, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline.
Sources
- GitHub Security Advisory GHSA-96xv-p87j-58mx; https://github.com/getgrav/grav/security/advisories/GHSA-96xv-p87j-58mx
- VulnCheck Advisory; https://www.vulncheck.com/advisories/grav-before-api-key-scope-bypass-via-pagescontroller