CVE-2026-72825 in Grav
Summary
by MITRE • 08/14/2026
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of requireSuper(). Because isSuperAdmin() reads access.api.super directly and never consults api_key_scopes, a least-privilege API key scoped to api.config.write minted on a super account passes the gate, allowing an attacker to append attacker-chosen tokens to the security.twig_sandbox allowlist (persisted to user/config/security.yaml). Widening the allowlist turns any subsequent Twig-in-content render into an SSTI/RCE sink.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability in the getgrav/grav-plugin-api plugin affects versions prior to 1.0.13 and centers on a critical access control bypass within the ReportsController's POST /reports/twig-content/allowlist endpoint. This flaw stems from a fundamental misconfiguration in the permission validation mechanism that undermines the intended security model. The endpoint correctly requires the api.config.write permission through requirePermission('api.config.write') but subsequently employs an insecure isSuperAdmin() check instead of the proper requireSuper() function. This design error creates a pathway where API keys scoped to api.config.write can bypass the intended super administrator privileges, effectively allowing privilege escalation.
The technical implementation of this vulnerability demonstrates a clear violation of the principle of least privilege as defined in CWE-250. The isSuperAdmin() method directly reads from access.api.super without consulting the api_key_scopes configuration that should govern token permissions. This architectural flaw means that even when an API key is explicitly scoped to limited permissions such as api.config.write, it can still gain super administrator privileges through this bypass mechanism. The consequence of this vulnerability is particularly severe because it allows an attacker to manipulate the security.twig_sandbox allowlist configuration, which is persisted in user/config/security.yaml.
The operational impact of this vulnerability extends far beyond simple privilege escalation into a full chain of exploitation that could lead to remote code execution. When an attacker successfully appends arbitrary tokens to the Twig sandbox allowlist, they fundamentally alter the security boundaries of the application's template rendering system. This modification transforms any subsequent Twig content rendering into a potential server-side template injection (SSTI) vector, where attacker-controlled input can be executed as code within the application context. The persistence of this change in the configuration file means that the vulnerability remains active across application restarts and sessions.
Security practitioners should recognize this issue as a classic example of insufficient authorization checks and improper privilege management, both of which are catalogued under CWE-863 and CWE-276 respectively. The vulnerability aligns with tactics described in the MITRE ATT&CK framework under T1078 for valid accounts and T1548 for abuse of privileges, as it allows attackers to leverage legitimate API credentials to gain elevated access. Organizations using this plugin should immediately upgrade to version 1.0.13 or later where proper authorization checks have been implemented. The fix requires ensuring that requireSuper() is properly invoked instead of the bypassing isSuperAdmin() check, and that all API key scopes are strictly enforced against the api_key_scopes configuration rather than allowing direct access to super administrator flags. Additionally, implementing proper audit logging for configuration changes and security-related modifications would help detect exploitation attempts and provide forensic evidence of unauthorized access.