CVE-2026-72824: Grav before 1.0.13 API Key Scope Bypass via PagesController
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check uses a bare isSuperAdmin() gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a super account can enable process.twig on a page save even though admin.pagestwig is intentionally outside the api.pages scope. When security.twigcontent.processenabled=true and editorenabled=false, this allows Twig-in-content to execute server-side, resulting in server-side template injection (SSTI) and remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.13 - Configuration
Set security.twig_content.process_enabled=false to prevent Twig-in-content from executing server-side (mitigates SSTI/RCE).
Grav API plugin / Twig content processing security.twig_content.process_enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72824?
The severity of CVE-2026-72824 is critical with a score of 9.8.
How do I fix CVE-2026-72824?
To fix CVE-2026-72824, upgrade the Grav API plugin to version 1.0.13 or later.
What impact does CVE-2026-72824 have?
CVE-2026-72824 allows an attacker to bypass API key scopes, potentially granting unauthorized access to sensitive operations.
Who is affected by CVE-2026-72824?
Users of the Grav API plugin versions before 1.0.13 are affected by CVE-2026-72824.
When was CVE-2026-72824 published?
CVE-2026-72824 was published on August 14, 2026.