The Grav API plugin before 1.0.13 contains an authorization bypass vulnerability in the PagesController::guardTwigContent() method. The vulnerability arises because the Twig-toggle check uses a bare isSuperAdmin() gate without consulting api_key_scopes. Consequently, an API key with limited scope (api.pages.write) but created by a super admin can execute process.twig on page save, even though admin.pages_twig is outside the api.pages scope. If the configuration security.twig_content.process_enabled is true and editor_enabled is false, this leads to server-side template injection and remote code execution.

An attacker with an API key scoped only to api.pages.write but minted on a super admin account can execute arbitrary server-side code via server-side template injection. This can lead to full remote code execution on the affected server, posing a critical security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API key issuance to trusted users and avoid enabling the security.twig_content.process_enabled setting if possible. Monitor vendor channels for updates and apply patches promptly once released.