CVE-2026-72824

Name of the Vulnerable Software and Affected Versions Grav API plugin (getgrav/grav-plugin-api) versions prior to 1.0.13

Description An API key scope-cap bypass exists in the guardTwigContent() function within PagesController. The issue occurs because the Twig-toggle check relies on a basic isSuperAdmin() gate and fails to verify api key scopes. Consequently, an API key with limited privileges scoped only to api.pages.write that was created from a super account can enable process.twig during a page save, bypassing the restriction that keeps admin.pages twig outside the api.pages scope. If security.twig content.process enabled is set to true and editor enabled is set to false, this allows server-side template injection (SSTI)—a vulnerability where an attacker injects malicious templates that are executed by the server—leading to remote code execution.

Recommendations Update Grav API plugin (getgrav/grav-plugin-api) to version 1.0.13 or later.