CVE-2026-72825

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.13

Description An API-key scope cap bypass exists in the ReportsController via the 'POST /reports/twig-content/allowlist' endpoint. The issue occurs because the endpoint uses the isSuperAdmin() function instead of requireSuper(). Since isSuperAdmin() reads access.api.super directly without consulting api key scopes, an API key with limited privileges scoped to api.config.write created from a super account can bypass security checks. This allows an attacker to add arbitrary tokens to the security.twig sandbox allowlist in user/config/security.yaml. Expanding this allowlist can lead to Server-Side Template Injection (SSTI), which may result in Remote Code Execution (RCE), where an attacker executes arbitrary code on the server.

Recommendations Update getgrav/grav-plugin-api to version 1.0.13 or later.