CVE-2026-72825: Missing Authorization in getgrav grav
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of requireSuper(). Because isSuperAdmin() reads access.api.super directly and never consults api_key_scopes, a least-privilege API key scoped to api.config.write minted on a super account passes the gate, allowing an attacker to append attacker-chosen tokens to the security.twig_sandbox allowlist (persisted to user/config/security.yaml). Widening the allowlist turns any subsequent Twig-in-content render into an SSTI/RCE sink.
AI Analysis
Technical Summary
The getgrav/grav-plugin-api plugin prior to 1.0.13 contains an authorization bypass vulnerability in the ReportsController's POST /reports/twig-content/allowlist endpoint. The endpoint enforces requirePermission('api.config.write') followed by an isSuperAdmin() check instead of requireSuper(). The isSuperAdmin() function reads access.api.super directly and does not consider api_key_scopes, allowing a least-privilege API key scoped to api.config.write but minted on a super account to bypass intended restrictions. This enables an attacker to append attacker-chosen tokens to the security.twig_sandbox allowlist, which is persisted in user/config/security.yaml. Expanding the allowlist can convert subsequent Twig content rendering into an SSTI/RCE vector.
Potential Impact
An attacker with a scoped API key minted on a super account can bypass intended API key scope restrictions to modify the Twig sandbox allowlist. This modification can lead to server-side template injection and remote code execution, posing a significant security risk to affected systems.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API key issuance to trusted users and monitor for suspicious modifications to the Twig sandbox allowlist configuration.
CVE-2026-72825: Missing Authorization in getgrav grav
Description
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of requireSuper(). Because isSuperAdmin() reads access.api.super directly and never consults api_key_scopes, a least-privilege API key scoped to api.config.write minted on a super account passes the gate, allowing an attacker to append attacker-chosen tokens to the security.twig_sandbox allowlist (persisted to user/config/security.yaml). Widening the allowlist turns any subsequent Twig-in-content render into an SSTI/RCE sink.
CVSS v4.0
Score 7.2high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The getgrav/grav-plugin-api plugin prior to 1.0.13 contains an authorization bypass vulnerability in the ReportsController's POST /reports/twig-content/allowlist endpoint. The endpoint enforces requirePermission('api.config.write') followed by an isSuperAdmin() check instead of requireSuper(). The isSuperAdmin() function reads access.api.super directly and does not consider api_key_scopes, allowing a least-privilege API key scoped to api.config.write but minted on a super account to bypass intended restrictions. This enables an attacker to append attacker-chosen tokens to the security.twig_sandbox allowlist, which is persisted in user/config/security.yaml. Expanding the allowlist can convert subsequent Twig content rendering into an SSTI/RCE vector.
Potential Impact
An attacker with a scoped API key minted on a super account can bypass intended API key scope restrictions to modify the Twig sandbox allowlist. This modification can lead to server-side template injection and remote code execution, posing a significant security risk to affected systems.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API key issuance to trusted users and monitor for suspicious modifications to the Twig sandbox allowlist configuration.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-10T15:12:59.509Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7f0284bf8831d539fec858
Added to database: 08/14/2026, 11:56:52 UTC
Last enriched: 08/14/2026, 12:12:35 UTC
Last updated: 08/14/2026, 20:04:53 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.